When it's a US company operating under US regulations, yes, it is quite different. This is the point of things like ITAR. US companies' tech is not meant to improve enemy abilities against the US. Using US companies' tech to improve US abilities is expected. I don't think that's hypocritical for the US government to have that expectation
It's just another example of tech out running legislation. Back when PGP was regulated, the internet was not so ubiquitous and was easier to try to keep the genie in the bottle. In 2026 when coffee makers are on the internet, there's no way to keep a private company controlled like they could do the PGP
