I don't see how you could disagree on the first point though. Not only is is often done today to varying degrees of success depending on country and technology, it was exactly how much of consumer crypto got its start back in the earlier days of the internet. During the 90's technologies like RSA, PGP and others basically got built and released while constantly treading all over extremely shaky legal ground. It was their widespread usefulness and steadily growing adoption by users that allowed them to in effect circumvent archaic laws until they were simply recognized as legally usable.