The thought process with export controls is that bad actors may be able to discover vulnerabilities more easily by having unrestricted access to defensive technologies.
In theory, Ali should not be able to buy anything from US companies at all, if they see his name. In practice this requirement is so absurd that compliance is poor, both due to difficulty and practicality.