Additionally it isn't that we have a clean slate in Germany (as an example) ourselves [1].
We can't trust any vendors. Be it soft- or hardware. Be it cloud. At least not when thinking about state level actors.
Nations need to think, as you said, about propper vendor mix and risk assessment.