I mean, if the stated intent of an export control is to allow domestic use but prevent export, achieving the stated intent is impossible, because every developer in the world wants the latest models and will get a VPN.
Can you imagine the disaster???
Why is that? Well, not to search very far, I just got a breach notice from a company I never heard of the other day. They are sorry.
Also, foreign nationals legally residing in the US can have access to US-based payments. There's no way when accepting a credit card payment from a US card issuer to ask whether the card holder is a natural born citizen versus Green Card holder, etc.