I think it's mainly an infohazard. You certainly don't need large facilities like for nuclear weapons that could easily be monitored by spy satellites. The virus could be produced in any normal building. And the ingredients are likely dual use for medical applications. This stuff isn't easy to control.