Earlier quoted context omitted.
Again, its easier to buy a cheap VPS in a country that is at odds with the one you're in. Then, any intelligence the other country gets will likely not be sent to the country of residence. Ally countries usually have extradition treaties, and have a greater chance of sharing intel.
Correlation is still quite easy in that scenario, unless you're sharing that VPS with a thousand other people. NSA has your international traffic logged and timestamped. If you're doing nefarious activity from a non-MLAT country's IP, and you're the only one connecting to it from the US, it's a simple matter of parallel construction for domestic law enforcement to pop you.
This is more just putting some circumstantial evidence together. Parallel construction refers to going out and getting evidence a second time, because you don’t want to reveal how you got it the first time. Usually because the first time it was collected was without a warrant, or collected from a sources or via a method you want to keep secret. So the evidence is reconstructed in parallel.