Keep in mind they have to defend against multiple state actors (Russia, China, even some much smaller countries with a lot of investment in SIGINT) who are also very competent and have a ton of attack vectors to work with.