They already bought the product, and it came with a license, then they wanted to unilaterally change the license. When they couldn’t, they declared the product a supply chain risk. The idea is you declare it a risk before you buy it.

Not to mention, they simultaneously said it was a supply chain risk and that it would continue to be used by agencies that were already using it in a critical capacity. Which makes absolutely no sense.