“Is country X a threat” is not a threat model. What drives risk in an outsourcing deal is third-party access design, jurisdiction and vendor control maturity. What the Verizon DBIR third-party figure really measures, what the DOJ bulk data rule says, what DPDP and CERT-In require of your vendor, and the control set that works regardless of geography.