I don't know the specifics here but many official sites also can have compromised parts, e.g. a subdomain with an old wordpress install or similar can get taken over.

Probably but I’d still prefer a link to a www.sba.gov page that links to this form.