I've never understood this take. A lot of people were saying this sort of thing when Proton Mail turned over some user data to authorities in Europe a while back.
If you're running a tech company and run afoul of the law in some or another jurisdiction, it doesn't matter how much spine you think you have. When a group of men with guns, i.e. the police, shows up at your door and gives you the option of turning over some customer data or spending the next 10 years of your life in a steel cage, I'm betting that practically no one is going to choose the cage, spine or not.
The only way to keep user data safe is to not collect it in the first place.
If you don't have a spine, sure
That's what US companies are seen as from a European perspective: Spineless and untrustable
It's a great sales argument for locally grown software though, so I'm not complaining :)