Never let the perfect be the enemy of the good. And if I'm processing personal data, the threat profile of sending that to a US-based company for inference is very different than the threat profile of sending that data to the EU to run on American chips. One is almost certain to end up in the hands of US government agencies and has a low but real probability to end up in training data or a data breach. The other is has much less immediate threats to my data