For these orders, the President’s Budget should include requests for Congress to provide appropriations for the work that will need to be performed (the delta between current state and expected state).
It is true that it's different when it's applied within the executive branch. The US executive branch has to obey the laws, but it does have some discretion on how it prioritizes the work. So, for example, it could prioritize some of these activities by de-prioritizing (and thus reducing the funds) of other activities. That's hard, because it's often harder to stop something you're already doing (there are often existing groups in place who will be unhappy if you stop it). But it's officially possible, and if it's important enough, then it can be done. The US government's executive branch bureaucracy cares very much about what the president orders, though when there's limited funding the work must be prioritized.
Some of these steps, such as creating new FAR clauses & adding them to contracts, don't require new money (though their results may impose new costs later). But it's fair to say that others will cause costs, and they'll need to go to Congress to try to get that funding.
But that's not insane. The attacks on SolarWinds and friends have been estimated to cost $100 billion in damage to the USG (that's probably too high, but it shows real harm). The latest Colonial Pipeline ransomware, which threatens the US east coast, is making the news. Congress lives on the US east coast. I can easily see that money flowing from Congress.
In terms of what should be done, I'm not sure whether companies should be expected recoup their costs by raising prices, reducing margins or expect federal funding. My gut reaction is that this level of security should be a cost of doing business and not require federal funds.