There's quite a bit of software that comes out as Open Source, from some of the National Research Laboratories[1][2][3], the DOE[5], NASA, etc.. But... not everything is Open Source, and I think there is still room for improvement there.

I mean, yeah, it's great that NASA has a Github org[5] and that they release a lot of stuff. But last time I looked, there was still at least a modest amount of NASA code that isn't Open Source that I would probably argue should be. The same can probably be said for the national labs, DOE, etc.

[1]: https://software.llnl.gov/

[2]: https://github.com/ORNL

[3]: https://www.ameslab.gov/cmi/cmi-open-source

[3]: https://energyplus.net/

[4]: https://github.com/nasa

It's a common thing, but is also a great example of over classification which is supposed to be avoided (for legal and other reasons, but a primary motivator of of over classification is just laziness, failure to evaluate what is being produced). There have been efforts to properly qualify software as unclassified (maybe FOUO, or now CUI) and only data as classified (secret or above), but then you have a large contingent of classifiers who still think security through obscurity works.

But it's being worked on, maybe one day more will be open source.