>"They go very deep underground (rather than lying on the seafloor) quite a distance out from the coastline, and stay deep underground until they get to the "landing manhole" which is nowhere near the beach. The manhole is generally surrounded by a security perimeter. The "landing station" where the NSA's equipment sits is either in the same compound or (less ideally) very nearby. In the latter case the cable run from the manhole to the landing station has to be protected as well."
This is not true. Cable is only buried when the depth is less than a 1,000 meters. At 1,000 meters and above it just sits on the sea floor.[1] There is also no "manhole" where a cable pop's out of the ocean floor. The NSA does not need to be in a cable landing station, there is no benefit. The wavelengths can be peeled off fibre optic cable anywhere along the path. Hence why they were doing this at an AT&T Central Office on Folsom Street in S.F.[2], nowhere near a cable landing station. Cable landing stations are actually pretty uneventful places, generally some nondescript industrial park. The security there is the same as it is at any IX or data center.
[1] https://www.nec.com/en/global/about/mitatv/02/2.html
[2] https://en.wikipedia.org/wiki/Room_641A