Why would they serve a secret subpoena and gag order, when instead they can just drive to a secluded location 5km away from the super secure datacenter, dig a few meters down, passively tap a strand or two, facility and service operators none the wiser?

They’ve already done both. When they can get a cooperative party (AT&T, for example), they colocate their splitter equipment. When they can’t, they tap undersea and overland cables.

When it’s a hostile environment entirely, they hack and do secret operations and bribe.

The data would/should be encrypted; while the NSA did successfully tap Google's inter-datacenter traffic before the Snowden leaks, since then it is encrypted, too. Hopefully other providers won't fall for that trick anymore, either.