It's not just only limited to commercial spyware. It's limited to restricting "commercial spyware that poses significant counterintelligence or security risks to the United States Government", ie they should only use high quality commercial spyware.