They do not export devices, they export services.
There are some rules around when you knowingly know that a customer is military or WMD, and you obviously can’t supply services to someone on the entity list; but KYC-through-credit card kinda works at small scale.