It makes things less convenient but there are other entry vectors such as USB drives, Hard Drives, firmware, etc. Moreover, they could just use their local (inside Iran) assets --of course, one would probably not want to make it easy to trace back to assets, so maybe internet cafes and such.