PRISM was FISA, and was overhyped. There's a known (and legal) procedure for law enforcement agencies to go to major tech companies with a warrant and say "We need all the information for the account holder of xyz@gmail.com, because they are the subject of an active investigation." There are some concerns about how FISA courts are just rubber-stamps and don't actually read or challenge the warrants for validity, but at least nominally, the procedure is above-board and legal.

The next Snowden disclosure (MUSCULAR) was significantly more concerning though. It was that the NSA was tapping the internal fiber of Big Tech companies. I was at Google when the Snowden disclosures broke, and read the SRE postmortem. They found 2 fiber cuts underneath the English Channel, an hour apart, lining up with the start of the program as disclosed by Snowden. My inference is that the NSA paid off MI6 to send a submarine commando team to cut and tap the fiber of an American company, without consent, and then all the data was shared through Five-Eyes reciprocal data sharing agreements. Google leadership was hopping mad after this, but it would've been impolitic to bring it to the public. They started encrypting all internal traffic soon after, assuming that their internal network was compromised by various nation-state actors, which had some unfortunate effects on their internal culture of openness.

Good practice in general to not trust your internal network.

The head security guy where I worked 20 years ago was already saying this.