We do block on the network level. You can argue that it's an over-reaction, but legal does see a difference between something embedded into a binary purpose built to transmit data to a third party and a general purpose tool that could be mis-used.
And iTerm2 itself has allowed for custom python scripts to be loaded for a long time [https://iterm2.com/python-api/] easily modifying the behavior (and also allowing outbound connections wherever...)
If you work in a sensitive environment and outbound connections to OpenAI are already blocked on the network level (or even better iTerm is only able to communicate to whitelisted hosts, then problem solved... there really is no issue here for people to be so worked up about).
Sounds like legal really needs to understand these tools better.