Your view includes only a fraction of the real world.
From a european ISP standpoint: the introduction of a systemic weakness is a violation of Art. 32 GDPR. We just can't do it.
Classic double-bind. GDPR is more important than Australia to us, so we just block all access from and to austrialia. We have 195.000 affected webhosting customers (domain, email, website, servers), btw.