There are plenty of companies that are opposed to certain operations of the US military and refuse to sell to the US military on those grounds. None of them are considered a supply chain risk because that's not what a supply chain risk is.

A supply chain risk is specifically an entity that is likely to maliciously sabotage the US military's operations, such as Chinese companies that are controlled by the CCP. It is not simply a decision to "not buy from this company", but rather a wide-ranging decision that this particular company is a national security threat.

Or is known to have weaknesses that might permit such actions. Microsoft permitting Chinese workers to maintain DOD systems presented a supply chain risk, even though MS themselves were not the ones likely to behave maliciously. Instead their policies were so stupid that they invited potential malicious actors into the facilities.