Except that in the case of non-US companies NSA has to do the actual hacking. In case of US ones they simply need to "ask" a company to, say, handle them their master keys - much easier.