I'm sure they're also aware that few of their own citizens are in a position to run the model themselves, and that it's easy enough to use the system prompt to censor hosted copies for domestic consumption.

Censoring open-source models really doesn't make a lot of sense for China. Which could also be why local Deepseek instances are relatively easy to jailbreak.