You're stating that because someone is suspected of launching an attack from outside the US that they are "beyond the reach of US police". This is not a valid

You're stating that because someone is suspected of launching an attack from outside the US that they are "beyond the reach of US police". This is not a valid assumption. The US government has extradition agreements with most of the world's developed countries, and even where it doesn't, often applies political pressure to get what it wants. As an aside, this order is far more broad than you state here. It extends to people that have done business with them, in any capacity. That will in many cases extend to US citizens.