Within various parts of the US executive branch, presidential executive orders that say "do X" without funding to match are
also called "unfunded mandates" - at least sometimes. I certainly heard the phrase used that way. I don't know if that's an abuse of the term or not.
It is true that it's different when it's applied within the executive branch. The US executive branch has to obey the laws, but it does have some discretion on how it prioritizes the work. So, for example, it could prioritize some of these activities by de-prioritizing (and thus reducing the funds) of other activities. That's hard, because it's often harder to stop something you're already doing (there are often existing groups in place who will be unhappy if you stop it). But it's officially possible, and if it's important enough, then it can be done. The US government's executive branch bureaucracy cares very much about what the president orders, though when there's limited funding the work must be prioritized.
Some of these steps, such as creating new FAR clauses & adding them to contracts, don't require new money (though their results may impose new costs later). But it's fair to say that others will cause costs, and they'll need to go to Congress to try to get that funding.
But that's not insane. The attacks on SolarWinds and friends have been estimated to cost $100 billion in damage to the USG (that's probably too high, but it shows real harm). The latest Colonial Pipeline ransomware, which threatens the US east coast, is making the news. Congress lives on the US east coast. I can easily see that money flowing from Congress.