Seems they are officially based out of Cyprus, with a large parent (equity) company operating in multiple countries.
I’m betting at least some of those operations are in the US, although I couldn’t easily find a list to confirm. They could also have employees, such as developers, or operate data centers in the US. HQ isn’t especially meaningful in this context.
Not OP, but it’s not a new idea. I’ve seen that suggested, even in major news coverage, for the past 20 years. For a long time, any article criticizing the TSA and its effectiveness would point out that weak point.