*facepalm*
He has made technical data relating to Category I of the USML (Firearms, Close Assault Weapons and Combat Shotguns), which is specifically covered as "(i) Technical data (as defined in §120.10 of this subchapter)". ITAR has its legal authority defined under 22 U.S.C. 2778 of the Arms Export Control Act. Basically, SCOTUS has held that with few exceptions, the border is nearly Constitutional free zone.
Bernstein v. US Department of Justice is an opening that his lawyers will try to use. Which is a good argument. Currently source code relating to encryption has been given rights under ITAR that is very liberated. If he was smart, he would have written for a commodity jurisdiction. If (correctly) labeled as Cat I (i) ITAR material, he could then sue in federal court arguing Bernstein v Justice Department. In 8 years, we'd get a ruling of Yes or No.
Or he could label the material as ITAR tech data and distribute it only within the United States. State would have a hard time punishing him if he took reasonable steps to forbid foreign nationals access to the tech data. If someone else illegally exports USML tech data without a license, that's their business and not his.