You're right about the citizens thing, but multiple court cases over the years have asserted that constitutional protections only apply to "US persons". So, citizens, legal residents, non-legal residents, visitors, anyone physically in the US.
Visitors will be kind of a stretch, as they might not have any substantial ties with the US "community" to be protected by the Fourth. The opposite thing goes for the legal temporary worker who went to visit home country for a couple of weeks - he should be protected. In any case I do not think NSA takes all those things into account when they figure out who is a "US person" and who is not, if they ever do that, of course.
