I've seen network operators talk about it from all over the world.

If Sarah owns a gardening center and sells stuff locally, why does her business need to accept connections to her website or network from a foreign country? For her given the attack risk, it makes much more sense to block non-local traffic.