This is a sensible ruling. The sanctions were to prevent DPRK from using this protocol. In a traditional financial world this would be easy-ish with good KYC.

The fact U.S. people were blocked by sanctions was a side effect (eg; cannot distinguish between them). But the whole thing was pointless, as DPRK could still use it, of course, and U.S. people were the only ones negatively affected. To acknowledge this reality is quite pragmatic and reflects the reality of decentralized financial code on the Internet today.