All security is always a matter of cost. Clown theater starts once you lose track of it, and start doing security for security's sake.

RE obfuscation and nation states - nation states have finite budgets too, both in terms of resources and attention. They can crack any system at any time, but they can't afford to crack all of the systems all of the time.