They're already doing it. It's near impossible to do it effectively, if the contributor is comfortable interacting directly with smart contracts, but they're doing things like geoblocking their websites, making you click a box saying you're not in the U.S., etc.
Anyone tech savvy enough to contribute money to an ICO is tech savvy enough to connect to a non-US VPN before doing it.