At one time the NSA did that. The way it worked at one point in the 1980s is that a vendor could submit an OS for evaluation. NSA employees would test it, and if they could break in, they'd tell the vendor how they got in. The vendor got a chance to resubmit the system. One chance. If it failed on round 2, it was rejected.

Vendors hated it. I've seen a vendor group document asking NSA not to publicly certify systems at the highest levels because it make them look bad. They got DoD to go for a system where the testing was outsourced to private labs, and you could keep going back for a retest over and over again until you "passed".

Amusingly, computer security in those days wasn't a high priority at NSA for a bureaucratic reason. Computer security was at FANX, not NSA HQ at Fort Meade. FANX is the "Friendship Annex", a few miles from NSA HQ, near what used to be called Friendship Airport and is now BWI. FANX had all the minor functions of NSA - personnel, procurement, training, etc., and was considered a dumping ground for losers. Putting computer security out there doomed it.

What really killed security is that from 1940 to 1980, DoD was the major consumer of advanced computer and electronics technology. By 1990, the commercial sector was dominant.

Here are the early security standards books.[1]

[1] https://i.ibb.co/CJTTzDL/ivorytowerspeedtest.png

They already do this to a certain extent. Sometimes it's after the vulnerability has already been exploited by them or a sister agency. But other times it's soon after discovery.