I read your frustration. Try to let go of the fact that there are many smart people who aren't experts in legal affairs. Cite eCFR if they're wrong, and move on. As much as they don't know the rules, you don't know their situation.
For all you know, the subscriber may be a US Citizen + Delaware C Corp owner.
I remember a time not very long ago when everyday crypto like 128-bit SSL was restricted under US export law. The old web browsers came in separate, "exportable" versions. [1]
Phil Zimmermann was in big trouble for releasing PGP. That was the mid-90s. Clinton was President so this stuff transcends politics.
[1] https://en.wikipedia.org/wiki/File:Netscape_Navigator_1.1_fo...
This is different situation. Cybersecurity specialists (at least those I found and read) don't consider Mythos as something really powerful. Good tool but not groundbreaking.
Anthropic was playing terror game and burned by it