Everyone is subject to ITAR just like any other export control. It's generally more relevant to defense contractors and technology companies for whom the risks are higher for them as non compliance destroys their business model. The part that you seem to be missing is that it can be completely OK for a US citizen to see something; however, that US citizen cannot share that information with foreign entities. If a company reviews an article and redacts potential ITAR issues and the journalist publishes it anyways, the journalist is at at fault and, under ITAR, can be held personally liable (fines and/or jailtime). If the originating company was deemed to have insufficient safeguards in place they could also be punished (fines, loss of contracts, and/or jailtime). It's no different than when a cleared journalists publishes unauthorized classified information.