Also, outside of SCIF environments (which do get prioritized), there isn’t a whole lot that is feasible for DOD or other gov’t agencies to do while still using civilian technology or working habits, which they don’t really have an option on right now.

The whole industry and economy needs to be upleveled software wise in a lot of ways for meaningfully better security to be economically possible.

Typically that requires a serious crisis and/or war. Hopefully not the case here.