People keep coming up with other avenues by which China could get this information, but the court addresses that directly: the legislature is not required to address every instance of a compelling threat in one fell swoop.

I thought this too, but I think there's a new law for this as well: "In a bipartisan measure, the House of Representatives unanimously pass a bill designed to protect the private information of all Americans by prohibiting data brokers from transferring that information to foreign adversaries such as China" https://allen.house.gov/news/documentsingle.aspx?DocumentID=...