Well, your second question is basically impossible to do, as "security standards" are a constantly evolving landscape and being compliant with whatever the latest certification will not necessarily prevent you from being hacked. Also, it is much more difficult and expensive and potentially unconstitutional to enforce such a law, whereas enforcing a law that requires companies not to transfer money to certain countries or organizations is comparatively easier. It's also easier tell which side of the bright line any given action is on.
The explanation for the law is obvious and you seem to know it from the previous paragraph so I'm not sure what the question is. Is it controversial? For sure. Is it without any logic? By your own admission, there is an argument to be made.