I don't have great sources on hand, this is just coming from a career situated in or adjacent to protecting research and IP from espionage. As the national labs and prime defense contractors got exceptional at defending their networks, this pushed state actors into attempting espionage at the university level.
It's a lot easier to get access to underpaid graduate students, fresh post-docs, etc who are doing the heavy researching lift day-to-day work. You have way more tools in your HUMINT arsenal with this population. Sometimes research has natsec implications even though it is not in pre-class or classified status.
A famous example of this is how the US created it's stealth technology initially.
"The foundation for a science-based approach to the development of stealth aircraft was laid by Petr Ufimtsev, a Soviet physicist. In 1962, Sovietskoye Radio publishing house issued his book Method of Edge Waves in the Physical Theory of Diffraction that described the mathematical rationale for the development of stealth vehicles.
In the USSR, these ideas did not go any further, however, the Americans were very enthusiastic about them. Ufimtsev’s physical theory of diffraction has become, they say, the cornerstone of a breakthrough in the stealth technology. In the 1970s, the work was started in the USA on the basis of this knowledge as a result of which breakthrough stealth aircraft − Lockheed F-117 fighter and Northrop B-2 strategic bomber – have been produced."
https://rostec.ru/en/media/news/visible-invisible-stealth-te...
Again, the output of most University research is published in journals and conferences, with raw data increasingly available as artifacts. Publication does not always give all the data! Some proprietary datasets and tools exist, but the implications here usually affect academic competitiveness, not national security.
There are, of course, exceptions. Some Universities do classified or sensitive research where the result is not broadly published. There are fully classified labs associated with Universities, and some that just have sensitive research. But in general these are special exceptions and should be approached on a case-by-case basis, rather than with some blanket law. The assumption for University research should be: assumed fully transparent, except where there is a specific reason it isn't.