You should assume any of those are possible. And by that I mean: it's not physically possible to "control the technology" without instituting total surveillance and even that's just false security.
Defense is the only way.
You don't realize it, I imagine, but you're essentially advocating for the contemporary equivalent of requiring a license to print text on paper and distribute it.
We are not helpless. We can choose to control the technology and do so in a way that is in line with democratic principles. After Hiroshima, people assumed that most nations would develop nuclear weapons and that nuclear war would be commonplace. But Nagasaki was the last nuclear attack, and 80 years on, only a dozen nations have nukes. This technology makes nuclear weapons look like toys. We either choose to control it or we will be the victims of it.
I feel like this is quite a different situation. Building a nuclear weapon requires a lot of things to happen in the physical world that we can watch for. Weapons grade fissile materials must be sourced or refined, facilities must be build, you can't just do this in any machine shop. Various experts must be either poached or subverted or home grown. There are a lot of people with mouths involved. Then once you get past all of that you either have to test or just hope for the best at which point you will certainly be detected and likely handled with extreme prejudice.
Digital intelligence seems much less controllable. Near frontier weights are already out there, you don't necessarily need massive datacenters if you're not trying to serve commercially. Even if we we're somehow able to control what OTHER nations do through either treaties or threats of sanctions/force, working on this stuff is easily in range of many of the larger criminal orgs. Beyond all of that, there's always the chance that weights from authorized providers find their way "out the back door".
We've seen with crypto and darknet markets that even if you can fight this kind of stuff and catch bad actors, the most actual change you're going to effect is a temporary slowdown and the next guy who tries is going to be that much better. I don't doubt that regulation is going to be the initial route this goes, mostly due to the financial interests of the frontier companies and the desire to keep this build-out solvent for as long as possible rather than any true concern for actual safety and sanity. What's really going to need to happen though, in my very insignificant opinion of course, is we are going to have to change from the ground up how our digital infrastructure is built.
Maybe with the coming changes that is for the best too, our current systems are designed for people and I don't know the current numbers but it seems like agent traffic is already the bigger percentage. We may not be able to build our infrastructure on top of these large mountains of human designed legacy code. Maybe we need to be thinking about new kernels, new servers, new protocols and stacks.
We seem to be very quickly reaching a point where is something is not mathematically provable to be secure then it is not secure at all.
This is much more akin to books than it is to nuclear weapons. In my view you're proposing to tightly control access to something akin to the next generation of books. Is knowledge power? Yes it is and it's much more dangerous concentrated than distributed.