[jessaustin]

You're describing two different classes of threat. The threat posed by bad actors from the other side of the world is necessarily bounded: they can't take more from me than I have "online" in the first place. If I have a bank account, a secret soft-drink formula, or other assets subject to attack, what I spend on defense can be proportional to the assets themselves.

The threat posed by the bad actors affiliated with the state to which I am subject is qualitatively different. Based on intended-private information that can be construed as unlawful or even vaguely against the national interest, they can take away the rest of my life. There's nothing proportional to that.