A quick check says this contract has been in place since 2020.

The internet security practices I experienced when working with the DOD in a prior life were…interesting?

Outside of the classified realm, there seemed to be little to no on the ground understanding of the Internet. Many things where internet connected that shouldn’t be or weren’t that should. I was involved in one contract where we had to demonstrate the ability to remotely access and control a system (to satisfy the system’s owner) as well as demonstrate that the system could not be remotely accessed via the internet (to satisfy the base IT folks). The solution was a hotspot kept in a lock box…that I doubt was ever locked after we left because it was constantly attached to our internal monitoring network despite our pleas.