You're conflating two different things here. What Denmarks excels at it implementing public IT solutions that makes processes smoother, like patient records, medical perscriptions, digital signature, a nation-wide digital identity, things like that. Digital sovereignty isn't part of this, and Denmark isn't particularly good at it, nor is it really valued that highly. Same for cyber security, I'd say that it's down to dumb luck that it's not worse. There is a city, Randers, they can't send email to the domain anders.dk (Anders being a pretty normal Danish name). Why? Because the butterfingered public employees in Randers could stop sending personal information about citizen to anders.dk, which has a catch-all email. They simply forgot the "r". The problem is the lax attitude to emailing sensitive information, probably via a Microsoft run Exchange server, but rather than fixing that, they just blocked the anders.dk domain.