Consider that your server received a connection from an ISP that you know has global reach, and you sent the packages to IP addresses that are from a specific RIR and assigned to a specific country. That is if you are hosting directly if it's a third party, who knows.
Also, I am not a lawyer.
You didn't geobock the download or prompt for then user's address first in your scenario. So it may constitute export because it would be reasonable to assume that you clearly intended to make it available worldwide.
Phil Zimmerman was investigated for illegaly exporting munitions because he made PGP available via FTP. The case was settled, so I don't know whether this argument would ultimately have been successful.
Wyoming just passed a bill explicitly refuting this interpretation, other states are working on their own bills, and there is even a federal bill in the early stages.
The only exception that the US has ever acknowledged to this is ITAR, which is what the PGP case was built around, but it failed as you mentioned. But non age verified OSes are obviously not munitions.
If we allow this shit to happen, be prepared for evolution deniers to push their nuts agenda through the same channels and similar. Suddenly, we won't find wikipedia articles any longer and suddenly having a blog about biology will lead to one being investigated.
So it's strange that California is trying to compel speech when the ninth circuit has already said that software regulation is unconstitutional.
