That law exists at least since 2008, over a decade and a half ago. It’s plausible it was true and born from observation at the time. The first Snowden documents were published half a decade later, in 2013.
Yeah, so a decade-old now-dead trend isn't a "law" or we could be talk about the "Iron Law of jQuery: All sites will expand until they include at least three incompatible versions of jQuery".
