None of them have asserted that export controls apply to whatever domestic distribution the administration says that never leaves the country.
Please read the actual regulations and laws. They do not work the way you are assuming. Companies with obligations under these regulations are required to actively prevent constructive export via domestic distribution. If you let a foreign country launder access to the tech through domestic channels, that is on you. It is why KYC laws exist.
You don’t want to fuck around with export control laws.
Before you offer legal advice, you should at least check the legal definition of "export":
> The EAR definition of “export” extends beyond the transportation of physical goods outside the U.S.
> A “Deemed export” is the release of technology or source code to a foreign national in the U.S. The release is “deemed” to be an export to the last permanent residence status/citizenship of the foreign national. This can occur through demonstration, oral briefing, site visit, or through transmission of non-public data.
Ref: https://exportcontrol.lbl.gov/training/export-control-overvi...