It’s still in the lower-level guys’ best interest to leave foreigners alone, especially in areas where tourism is a major part of the economy. You start messing with foreigners, you give the place a “reputation,” and all of a sudden the locals are mad because their business is struggling, and the big boy cartels are mad because local businesses (that they’re often involved with) are struggling.
Notice that the kidnapping of four Americans made national news here. That’s exactly what everyone in that business doesn’t want. They have a vested interest in keeping a low profile, and making national news in the US is sort of the opposite of that.
Now, you get away from the touristy parts and into your Guerreros and your Sinaloas and your Nuevo Leons, that’s a different conversation. And even in the safer parts, you still get minor stuff like pickpockets and “cops” harrassing you. But you’re relatively safe from stuff like kidnapping and murder.