You seem confused why GitHub did what they did. In the US there is something called "US Export Law", the law includes declarations that makes companies unable to sell services/goods to certain countries (which spoiler, Iran is part of that list).

The law itself is not illegal, as the lawmakers have created and enacted that law. It's the opposite, the law is declaring what's illegal.

So, if GitHub doesn't ban users from Iran, they are breaking the law in the US.

Hope this clears up any misunderstanding on how things work.