> A security risk is by nature hypothetical. If the risk comes to fruition, it's no longer a risk, it's an event or an incident or whatever.

Not true. CPU exploits come out all the time with proof of how to exploit / exfiltrate data. This claim of a 'risk' is unproven as it's based on a poor hypothesis of 'country has our data === bad'