It's unreasonable to expect a small companies to have rogue nation states in their threat model. Apple, Microsoft, ... yeah but not a smaller business.