You could quite effectively set up access to Fable with know-your-customer, attested clients/workstations, and then inspection of what the session is actually used for to detect out-of-country use. It's not impossible.

If they had said only governemnt and a few other approved institutions can use it then yes that could work.

But they didn't say that. They said "only US citizens". Once something is available to hundreds of millions of people there will be leaks like it or not. Some accidental and some voluntary.

And even if it could be done it wouldn't solve the purported security issue anyway. Does anyone believe there are no criminals or terrorists with US nationality?

Yes, and that will be the future.

Except for xAI/Grok. Government officials in charge have deep connections there and will never apply such rules to them.