Judging by Ghidra, America's Army and BRL-CAD, it's amateur hour over there.
Also BRL-CAD's continued existence really should speak for it's quality considering it's the one of the oldest VCS tracked pieces of software and is the oldest public one. It's leagues ahead of a lot of gov and corporate tooling I've seen on both sides of the fence.
But otherwise yes, the mil-industrial complex often leaves something to be desired with development practices. The money all goes towards feeding systems engineers, mechs, mats, and sparkies. Software is usually the last consideration and is for holding together all the stuff the teams couldn't figure out how to do without it.
Things are getting better but it's a slow process and it almost entirely depends on software engineers sticking around long enough to get into leadership rather than leaving for better paying corporate or research jobs. While I'm on my way out now for a number of reasons, the industry is finally starting to get good at software practices and where it absolutely mattered they for a long time have tended to get it right.
Another interesting one is what Bohemia Interactive does -- they develop and commercially release simulation-style shooters in the ArmA series, and they developed the original Operation Flashpoint back in the early 00s. But Bohemia also has a product they sell to armed services around the globe. It's gotten them in trouble before -- a few developers were detained in Greece while gathering reference material for the fictional island of Altis in Arma 3.
They develop Virtual Battlespace which is heavily used by the UK MOD amongst others. The underlying engine supports a wide range of tactical simulations and there is a huge array of available reusable assets (e.g. vehicle meshes, textures, and behaviour models) that create a good moat to new market entrants.
Its popularity tanked once Americas Army 3 was out.
Some specific processors are noticeably unsupported (you can fix this yourself by writing definitions).
The extensions for analysis of mobile applications and debugging mobile targets are missing.
Parts of the debugger are still missing (eg: syncing debugger with disassembly/decompiler).
Some features are extremely poorly documented (eg: importing source code).
A lot of bits that otherwise seem missing are likely proprietary scripts and extensions/tools that probably can't be released due to either being classified or owned by a defense contractor.