TFA mentions that the use of the most recent citizenship or residency is the *current* situation, not the recommendation. The recommendation is that the process should be amended to look at the subject's country of birth:
Use of Foreign National's Country of Birth as Criterion for Deemed Export License Requirement
Current BIS deemed export license requirements are based on a foreign national's most recent citizenship or permanent residency. The OIG expressed concern that this policy allows foreign nationals originally from countries of concern to obtain access to controlled dual-use technology without scrutiny if they maintain current citizenship or permanent resident status in a country to which the export of the technology would not require a license. For example, transfer of technology to an Iranian who has established permanent residency or citizenship in Canada would be treated, for export licensing purposes under the existing guidelines, as a deemed export to a Canadian foreign national. This policy is described in the deemed export guidance provided on the BIS Web site at: http://www.bis.doc.gov/DeemedExports/DeemedExport
The OIG recommended that BIS amend its policy to require U.S. organizations to apply for a deemed export license for employees or visitors who are foreign nationals and have access to dual-use controlled technology if they were born in a country where the technology transfer in question would require an export license, regardless of their most recent citizenship or permanent residency.