It's getting centralized anyways, just not inside any federal agency. Instead they're outsourcing it to companies like MS and Google who provide hosted services. This gives the agency cover so long as they do their part (like making use of MFA, using encryption on email). Then they can offer a claim of making their best-effort and going with industry "standards" (standard as in common, not as in ISO, ANSI, or others).