You have to show your hand at some point

You're right. That's how it works and what makes it effective.

You have a pool of 100M end users and you can whittle that down to 5M potential suspects [...]

It's far worse than that. It starts slow. But once they got several distinct factors, those multiply and it goes down fast. Think for example location tracking. There might be 5,000 people around. Or passing a cellphone tower along the highway roughly at a similar time. Then you take a single second measurement, when they head back home. And you got them. It's very unlikely that two or more people pass that point twice at the same time. (Exceptions apply.) Or browser fingerprinting. There are websites where you can check your browser fingerprint. They've always told me mine is unique amongst hundreds of millions of internet users. They only need half a dozen or a dozen or so different factors to narrow it down to one exact person (or device). It's not always like this. But more often than not.

Far easier to [...] running honeypot websites [...]

Yeah, I guess they're not stupid. There are a lot of simple and effective things available. I'd pick the low hanging fruits, too. That's a sound choice.

you do still occasionally see the knock-on effects downstream

Sure. I'm not an expert on this. I have to look up most things you said. But US foreign policy sure had it's positive and negative consequences. For a lot of countries, in the middle east and all around the world.

These systems work hand-in-glove [...]

I'm pretty sure that's not a conspiracy or intended. But yes, a lot of that is consequential. Or symbiotic.