Originally I thought the requirement that we be citizens was naïve because, whether the odds were better or worse, there obviously have been cases where US citizens showed no loyalty to the country. But further thought convinced me that, assuming they get physical custody of the culprit, it’s much easier to charge citizens with crimes than foreign nationals, and it’s generally easier to get other countries to cooperate to turn over physical custody of a US citizen than foreign nationals.
Obviously, there are exceptions to this. The US has a much better chance of getting Assange than Snowden right now. But I believe, in general, the requirement isn’t about avoiding a security breach, but instead about punishing the culprits after the breach is discovered.