Am I surprised they used a list of ccTLDs to get a list of countries? No.

Am I mildly amused to know someone somewhere had to manually remove Soviet Union (.su) from a list of countries to put a tarrif on? Absolutely.

Why wouldn't they use ISO 3166 directly which doesn't contained outdated countries?

Americans and ISO? That sounds like an oxymoron.

I mean, any "definitive" list of countries is gonna be inaccurate in some way.

For example, according to ISO 3166, Kosovo is not a country, but Antarctica is, which isn't particularly useful in real-world scenarios. Kosovo does have its own ccTLD (.xk, although it's supposed to be a temporary one) and were tariffed.

The reason I've mentioned Soviet Union in particular is that its domain is still active. You can go and buy .su right now, unlike say .yu (Yugoslavia), .dd (East Germany) or .cs (Czechoslovakia), which were deprecated.