There's no dispute that this bill exists specifically to target TikTok, and that it will likely result in at least a temporary shut down, permanent if they choose not to divest.
Apparently there are a bunch of prior rulings on the meaning of "bill of attainder" though which say that that isn't within the typical meaning of punishment as used to define it. To quote just a bit of the courts recitation of previous cases
> See BellSouth I, 144 F.3d at 65 (explaining that although “structural separation is hardly costless, neither does it remotely approach the disabilities that have traditionally marked forbidden attainders”); see also Kaspersky Lab, Inc., 909 F.3d at 462–63 (comparing a law requiring the Government to remove from its systems a Russia-based company’s software to the business regulations in the BellSouth cases)
I'm not really knowledgeable about bills of attainder, but I think it might be useful to understand the distinction they're making to be one between "punishing" (the bill is, it hurts) and "punishment" (it's not because that's not the purpose, it's a side effect). There also appears to be a higher standard to qualify as punishing a corporate entity than an individual, which strikes me as a bit strange, but if I'm reading this right is settled law.