I’m wondering if this is a real threat, or a conspiracy theory. If it’s a real threat, wouldn’t be the same with the NSA?

I’m also a switcher from ovh to hetzner. Good service, good support, fast machines, the administration website is very good (ovh was slow and ugly), snapshots and backups are cheap and directly available (AFAIR ovh snapshots required a monthly fee). Hetzner is Germany based, good for GDPR, and now they have data centers in USA too.