> If a provider conspires with the NSA (or similar organizations) to subvert the privacy of their paying customers,...
This is only one type of interceptions the NSA might be interested in. But it is also also very interesting for the NSA to have weak air encryption by default, because 1) it leaves no traces at the provider, or 2) it allows eavesdropping on ANY provider, even a not friendly one. See the Crypto AG scandal for an example of what the NSA is capable of.