I think the reason he calls it outdated is the definition of "business" becomes murky when it comes to online services and SaaS companies. Does servicing an HTTP request that appears to come from a sanctioned country (based on unreliable GeoIP data) actually count as "business" for sanctions purposes?
The specific prohibitions vary by sanctions program, but there are some that prohibit companies from providing “services” and the answer as to whether that includes SaaS is right there in the name.
Companies are required to do due diligence to determine that they aren’t engaged in activities that are sanctioned. GeoIP is less than 100% accurate… but so is comparing first and last names. Unreliable data is not something inherently unique to the internet.