It also feels deeply wrong to pull the "but all the research efforts that did not lead anywhere" argument, when Pfizer did not do the research in the first place. They should get compensation for organizing the huge trial, of course; that expertise was why they were on-boarded in the first place. And nobody expects them to manufacture that stuff at loss or cost. But we should not accept public money buying them goose laying golden eggs either.
Security made in <foo> is always a PR stunt. Deutsche Telecom, 1&1 and others tried it by pouring huge sums into an "Email made in Germany" campaign that only benefited a particular consulting company. It utterly failed because their geo-fencing idea was technically unenforcable.
CH is more dangerous because the same idiotic ideas brought to Switzerland will often take off. Most EU security companies I know would not easily consider CH as a great location unless it has something to do with business strategy: 1) tax, 2) location of a holding company see #1, or 3) sell into the CH market.
On the other hand many non EU based security start-up CEO's often talk about it as it had some security benefit. But as you say this is a huge lie since data protection has nothing to do with banking secrecy and even when the latter is in question a New Mexico LLC is a much more secretive vehicle than a Swiss GmbH/Srl
[0] https://de.wikipedia.org/wiki/E-Mail_made_in_Germany
[1] https://www.telekom.com/en/media/media-information/archive/d...
But at their scaling, enabling TLS means a lot of additional compute power, and due to that marketing campaign they now finally got the budget to install the additional hardware and enable it. Before, there was no business value that justified to spend that much more to get an - to the outside observer - unchanged product.