The court of appeals thought about it and decided it wasn't. Start on page 59 of their ruling [0].
They tried to appeal this to the supreme court, the supreme court declined to hear that part of the case. See bottom of page 34 on their petition for a writ of certiorari [1].
[0] https://storage.courtlistener.com/recap/gov.uscourts.cadc.40...
[1] http://www.supremecourt.gov/DocketPDF/24/24A587/335257/20241...
Reading the appeals court case, it appears that they did agree with it being a bill of attainder but decided the national security implications overruled it?
Not how I would phrase it.
A bill of attainder is two things, it targets a specific person, and it punishes them.
They decide the bill definitely targets TikTok, which is possibly close enough to a "specific person", but it doesn't punish them. Thus it doesn't satisfy the second prong and they don't have to even finish deciding the first prong and left the "possibly" in there.
National security really comes in when trying to decide it was a punishment. It's not a traditional punishment, but one of the other ways they could decide it was a punishment would be if it didn't further any purposes but punishment, and in this case the purpose it happens to further was national security. As far as I can tell this analysis would be the exact same if congress passed the bill instead because they decided TikTok was harming schools ability to keep order. It just has to be any non-punitive purpose.