The military is allergic to internal software. First of all you have to understand IT in the military is a different world far beyond your imagination because everyday they are under attack by the best nation-state cyber intrusion people on the planet. Your start up will never experience this and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important. The only commercial organizations that even come remotely close to what the military experiences daily are large financial organizations. Also, don’t forget the US military is the largest single employer on the planet, like 4.5 Walmarts.
So the military monitors everything at multiple levels. That also means locking things down to approved software lists at different levels. The people writing the security policies and/or performing the monitoring likely aren’t experienced software directors. They look at things like NPM and Maven and just see unlimited attack vectors from people who have no idea about security, and they aren’t wrong.
Then in the civilian and contractor space where do you put the code. If it’s paid for by the government then it’s owned by the government otherwise the contractor company wants to own it completely separated from the government so they can charge the government for it. Then consider if it’s a subcontractor not aligned to the financial goals of the prime contractor. Even when the government wants to do the right thing it’s complicated. As a software guy under a non managing co-prime I really don’t give a shit and say just give the government everything and it’s weird to see people try to throw up layers, especially since the government side is always less restricted because they almost always achieve vastly superior security accreditation on their infrastructure.