This argument is equivalent to saying a data center isn't secure because a nuclear bomb can fall on it.

The usual reason for doing this is to convince auditors or lawyers that the system is in compliance with GDPR or similar legislation, not to resist the attention of three letter agencies. If you can say you’re using industry standard / government approved crypto it should be fine.