Very my doubt that's going to stop US law enforcement. They go after people all over the world. And if they really want you and your country has an extradition treaty it tends to favour the US side.
I'm not really sure what your point is. Because they're Canadian, they can't make a call to the FBI? They're Canadian, so they should report to a Canadian authority about US Citizen data? They're Canadian, so they're funny and this is a joke?
First I wrote: I would try reporting it to the company, maybe also the FBI or FTC
Response was: Please do not ever communicate directly with anyone from a federal law enforcement agency. Only talk to them through an attorney. They are most definitely not on your side.
Then I wrote in response: The guy is from Canada.
So all three of your guesses are wrong. I'm stating that a Canadian has much less to worry about (compared to a US citizen) when contacting a US law enforcement agency about a compromise in the security of a US company that impacts multiple US states.