Since it is about public institutions, any public servant disobeying will be disciplined. That can include strongly worded letters, demotions or even firing. For public institutions spending money on (for them) illegal goods, activities or licenses is not possible, which means that any receipt they hand in for that won't ever get reimbursed. Which also means they wouldn't get the goods in the first place, because the business selling them knows they will get stiffed.
Isn’t it notoriously difficult to fire or demote anyone in the french bureaucracy?
IT departments in the various branches of the administration have to follow the guidelines of the government, it's not really hard to implement in that sense. What's harder is avoiding shadow IT.
Shadow IT implies that IT departments don’t care enough to expend effort to crack down. Is that common in France?
My work experience is that it happens everywhere crackdowns and directives get in the way of productivity. Ultimately between getting things done and sticking to the rules, people often pick the first option. I'm also guilty of it to an extent.