This is how the UK interprets things, but they seem to be alone on this in the present day.

Wyoming just passed a bill explicitly refuting this interpretation, other states are working on their own bills, and there is even a federal bill in the early stages.

The only exception that the US has ever acknowledged to this is ITAR, which is what the PGP case was built around, but it failed as you mentioned. But non age verified OSes are obviously not munitions.