fwiw towards your theory, I believe that the US Govt actually considers cloud providers - by way of specific services offered "dual use" systems for mil or civil use.

E.g. you will find references in AWS docs to Bureau of Industry/Security rulings.

https://en.wikipedia.org/wiki/Dual-use_technology

https://www.bis.gov/

https://aws.amazon.com/compliance/global-export-compliance/