As someone who works daily with export-control-adjacent hardware and software, my experience is that people tend to aggressively self-censor to a far higher standard than export control regulations actually require. The perceived headache of drawing the ire of whoever it is the enforces this stuff (which as I type this comment I'm just realizing I don't know who specifically is responsible for that) is so scary that people don't want to take any risk at all of being targeted.