I sense the classification of cryptography as a munition is a relic from the past.
Cryptography has historically been the domain of the military
Look at this NY Times article from 1996, for example. There it describes "boxes used to surf the World Wide Web" as weapons.
Cryptography has historically been a major deal in warfare. Sending messages to coordinate troop movements without the enemy being able to decode them in order to maintain the element of surprise is a huge strategic and tactical advantage in combat.
Consider the following subjects of history:
Before the internet, the military (and banking and finance) was the primary domain for encryption technology. The NYT article suggests to me that when the internet became popular, it fueled military concern of superior encryption technology being used for its historical military purpose. They had no frame of reference in history to give them a sense of its peaceful, commercial applications. Most likely.
Courts haven't caught up yet
If encryption is still classified as a munition, it's probably because that issue has not had time to work its way through the legal system. And that might likely be because it hasn't been enforced in a way that would lead a company like, say Google or Amazon, to challenge it.