And as with software, sometimes part of the intended purpose of the software inherently exposes you to threats, and saying "Shut down the threat" means shutting down the software. The easiest way to prevent people from defacing Wikipedia is to make it not a wiki. The easiest way to keep your computer secure is to unplug it from the network.

Having foreign students attend our colleges is something that we have long recognized is good for our country and for the world. Obviously it's an attack surface too, in the same way that Wikipedia's "edit" button is an attack surface. But if we want to actually maintain the policies and goals that led us to deciding that we want foreign students to attend our colleges, we need to be clear about why these particular foreign students are different.

Yes to all of these, but this is just cherry picking the negatives. On the flip side, if you want to make positive changes, you also need the same knowledge. And if one believes that the Chinese students are brainwashed by their government, what better opportunity to teach them "the truth" than by hosting them in America for a few years?

Using the software analogy, it's like the observation that the only computer that's "safe" from internet hackers is one that not connected to the the internet (and ideally turned off). While (mostly) true, it's not a particularly useful observation unless one is willing to forgo all the positive aspects of connectivity.

one doesn't necessarily need to anticipate a specific threat to recognize attack surface.

I'd agree that it's worth identifying the vulnerability, but I think that to be useful the emphasis would need to be on the differential of the potential threat versus expected benefit. I guess I believe enough in the general positives of education that in the absence of specifics I'm willing to bet that educating Chinese students is a net gain for the world.