Note the subhead:"Doesn't stop local courts' surveillance orders, though"
That is hitting the sweet spot for the balance between privacy and security. The default is and should be privacy, with data not necessary for the functioning of the system not collected at all, and any data needed to be collected for the system to function to be encrypted where technically possible, and in any case deleted after no longer needed.
If police/prosecuters have a specific* request, they go to a judge with any evidence. If the judge deems that evidence good enough, they get a warrant for the provider. The provider only starts collecting additional data not needed to run the service when compelled by warrant, only within the limited scope of the warrant. And when ready, hand over the data to the requestor, stop collecting data again and delete themselves any data they collected.
I appreciate it makes life more difficult for investigators, but the solution is to train and resource investigators better, not to allow fishing trips.
* designated person(s), limited scope, limited timeframe - if scope needs to be extended / renewed, get another warrant!