They'd be wrong. Especially about Europe. Many companies are in a bind about this: they can't upload their confidential files to a service provider but they do want AI. So right now they end up with a choice: do nothing, breach their contracts, use a service provider that pinky promises not to share their data (which we have already seen they will violate) and run local models.
The latter is the reason you can't buy powerful GPUs for reasonable prices because a local model (GLM 5.3, DS 4, etc) + some hardware is all you need to solve the problem in a way that avoids the legal issues.