I don't quite get it either, but one of their documentation files seems to imply that they can:

>In countries where copyright protection is available (which does not include the U.S.), contributions made by U.S. Federal Government employees are released under the License. Merged contributions from private contributors are released under the License.

https://github.com/NationalSecurityAgency/ghidra/blob/master...