The article says that these restrictions on research with a "foreign component" have been in place since at least 2003 but have only recently been clarified to include the researchers themselves.
It's actually more surprising to me that NIH and NASA research co-authored by non-Americans was supposedly not requiring scrutiny under the "foreign component" rules before this.
I heard NIH grantees had to always jump through extra hoops when hiring foreign companies or purchasing foreign products
Many graduate students, faculty and post-docs are foreign citizens. So banning them from conducting research could potentially shut down big research projects. It is not surprising to me that the NIH and other funding agencies didn't want to do this. (It is also unsurprising to me that the current administration would have few qualms about disrupting research: we know they don't care, ask the cancer studies that had to be saved with private Foundation funding last year.)
Before you start throwing disruptive rules at projects, you generally want to know that there is a critical security concern for that specific work. Most research just gets published a few months later, so foreign interests can just read it in a journal and download the dataset.