Or they could just not buy the product in the first place. The supply chain risk part is pure retribution.
They don’t buy the product, and the product can’t be used in the things they do buy.
These blanket rules are very typical in large organizations.
Not to mention, they simultaneously said it was a supply chain risk and that it would continue to be used by agencies that were already using it in a critical capacity. Which makes absolutely no sense.