Russians and Chinese have both implied there are deadly viruses in the facilities..
So a virus might skirt the prohibited list.. isn't necessarily a weapon.. but can obviously be weaponized.. so they can deny all they want, but they've got the viruses/research etc..
And if they simply have some series of shells and holding companies with some random nationals names on it, they can say its not theirs, too.