> it probably is an anomaly that this was government funded

Companies can definitely fund it. But to be fair the gov, including NIST, also relies on CVE.