>So are American nationals less likely to use it to search for exploits

Well, in theory, it is easier to prosecute U.S. nationals if they "do bad things"

Although in practice I assume it's basically impossible to prevent a secondary market from developing which sells illegal access