That's practically what ITAR is all about, limiting access to US persons. We're focusing on the weaponization of AI models via cyber, but it also allows a small group of people to act in really nefarious ways. The intelligence is not just about being smart individually, as in no one person can make a pen, but companies like Apple and Google make great products, and they're just collection of persons and processes.

>So are American nationals less likely to use it to search for exploits

Well, in theory, it is easier to prosecute U.S. nationals if they "do bad things"

Although in practice I assume it's basically impossible to prevent a secondary market from developing which sells illegal access