So it would be possible if the state demanded that VPN companies provide adult sites with continuously updated lists of their exit nodes.

It also seems to me like Utah could just demand that adult sites only accept traffic from residential ips.

You'd have to ask every non-residential host online to do the same. As above, you can get a DigitalOcean droplet and ssh -D to it, now you have a SOCKS proxy that for state's concern is doing the same as a VPN.

Utah could demand the moon, it doesn't mean that the federal government would agree they have a right to that demand.

Utah can't tell businesses that service the country (or the world) how to do anything in this regard. You can't demand a list of the VPN exit nodes, because no VPN would ever give you that, and if they're outside of your jurisdiction, how could you possibly enforce it (assuming you got the Feds to agree with your law regulating interstate/international commerce now). You can't tell websites to only accept residential traffic, for the same reasons.

The internet sorta fucks states rights (in a good way).

Why would a VPN company care about what Utah requires if they have no legal presence there(or in the US for that matter)?

Besides, there's no such thing as "residential" IPs. If I set a VPN gate at my mum's house, how would the porn company know?

The "impossibility" is in them saying "we cannot guarantee with 100% certainty that the user isn't using a VPN" and that's correct, they can't - but the law has no provision for that, they are risking fines over something they cannot control.