Paying an American company—and such a subsidiary shell company, despite being purely a legal fiction, is still an American company—for its services, no matter who owns it, should not result in China being taught how to build your tech; and it's not the responsibility of other American corporations to ensure it is. If such bad things happen, that's the fault of the American government for allowing the business relationship between the foreign company and its American subsidiary to exist, in light of clear treaties (WIPO, for one) that require the American government to embargo trade with countries that don't comply with them.

By analogy: it's not your web browser's responsibility to protect its memory from other processes snooping on it. That's the OS's job. If another process can read your process's memory, it was a failure on the OS's part. The process shouldn't be expected to be spending resources securing its memory; it should be expected only to pay its dues to the OS (in e.g. context switches) such that this gets handled for it.