It's a bit like .gov and .edu; technically exclusive to the US. The difference is that .com and .org were opened up for anyone to purchase.
And it goes deeper than just intent: .com was literally administered under a US government contract for decades, with Verisign only ending up in control because they acquired the company that held that government contract.
So while anyone can buy a .com today, the infrastructure and oversight have always been firmly American.
Yeah, I always thought that real security is priority #1. But, using convenient obscurity lowers the obvious attack surface to things like automated scanners, just a bit.
Source: own multiple, via EU registrar
(Edit: Parent was edited after reply - parent statement is now correct)
reply