This is both absolutely key, and also irrelevant. 'Security' is clearly a pretense, as otherwise the demand would not have been restricted to 'foreign nationals'. It is not like any US administration every trusted every 'US national'.
But the reason for the restriction is basically irrelevant. The fact that it happened, should be the final wake up call for the EU to take 'Digital Sovereignty' serious. Not just in 'talk', but with actual commitments in budgets and effort.