They have to tighten that up so much that it would effectively result in "US Corporations cannot source anything from a foreign state".
After all, if you are allowed to outsource (for example) customer-support to EU, the company you are outsourcing it to can effectively use Kimi without disclosure.
Sanctions are already that tight since they are strict liability. You do business with an overseas vendor and they use a sanctioned product, you are still liable even if you have no knowledge of its use.
In practice, outsourcing just becomes much more expensive, going through intense know your supplier audits, and you throw an indemnification clause in the contract and pass your fines onto your outsourced vendor.