The important part about implementing something like the great firewall, or how Iran runs the Internet (All ISPs need to be downstream of the government-run ASN), is that you need cooperation from the people with network engineering talent.

If all of them refuse to help implement your new internet censorship regime, it's a problem for any authoritarian government, just as much as if your police force stops following orders. You can start firing people and hiring replacements who will toe the line, but at a certain point you're going to end up with second and third rate talent, and correspondingly shoddy ISPs.

Talented network engineers such as those who have the equivalent of 'enable' on the twenty largest ISPs in HK can choose to go elsewhere and work in free countries. There's sufficient demand for their skills that refusing en masse to cooperate is not an incredible risk for them.

I work in the field and try to teach junior NOC people that there is such a thing as ethics in network engineering. Just as there is in any other professional field where people rely upon critical systems. This means, among other things, don't try to MITM your customers' traffic (Kazakhstan, recent incident comes to mind), don't get into intrusive DPI, don't fuck with neutrality of content, and absolutely never cooperate with anything that slightly resembles the great firewall. The combination of modern technology/human tracking systems plus full autocratic state control of ISPs could result in something that would be the wet dream of east germany's Stasi.