Sure, this law won't stop these tools from leaving the USA, but may still be effective in bullying and retaliating against US based security researchers when they piss off the wrong people.
You presented your research at a conference outside the US? => That's export.
You put your software up on the web for everyone? => That's export.
You posted details to a mailing list which is hosted outside the US? => That's export.