Why would you find that hard to believe? The NSA has been putting their own hardware in other people's data centers and requiring their SSL keys, for example. So it certainly happens in the US.
Yes, but providers don't have much choice in that case. (also because the company has to follow local law) But with all available interconnects, there are many places in Europe where you could open a datacentre and not have to deal with GCHQ requests. It's not the case about every spy agency with every company - it's about specifically US companies like Facebook / Google and GCHQ.
