I can't answer whether any company whatsoever does purely commercial work with no ITAR restrictions, but mostly this won't be the case. US aerospace companies mostly all do US defense work, and in order to be able to do that, they need to prove to the DoD that all of their network infrastructure is secure in particular ways, and that includes pretty strict separation of anything that touches ITAR covered data from everything else. This usually means most jobs are going to require you to be a US person physically residing in the United States. They don't want to risk some diagram you need to look at going across transatlantic cables to get to your workstation. Doesn't matter if it's end to end encrypted, VPN, whatever, they still don't want to risk the intelligence service, secret police, whatever it is of your country coming into your house at gunpoint and forcing you to login and retrieve stuff they're not supposed to see.
Fair or not, this kind of thing will prevent true workforce internationalization and parity between US and non-US developers well into the indefinite future. Remote jobs certainly exist even in aerospace and defense, but not global remote.