They can restrict it to US citizens only: just do KYC and enforce it. Any citizen exporting ITAR capabilities would be committing a felony.
I think it is inevitable that more capable models will require export controls, KYC, background checks, verification of credentials, etc. Even if you don’t buy Anthropic’s marketing of their current models, there is a future where models are capable of developing chemical weapons, biological weapons, cyber weapons, etc. which are genuine security threats governments will care about controlling and preventing. Maybe this prevents big commercial labs from developing more capable models until they figure out appropriate safeguards, but this is a good thing, a world where you can ask an LLM for an airborne rabies genome and it will simply produce it for you is not a world we should want to live in.
Identity theft is a thing. And if you gate a desirable commodity behind an identity it will becomes even more of a thing.