"$600k is a lot of money to implement an existing standard."
Not if such a requirement includes things like FIPS validation, which is entirely possible in this case.
Plus, in some cases, these things are done in liu of donations, etc.
I can think of plenty of cases where well known contractors on open source projects have been paid very well simply as a way of showing support for that project.
$600k is a lot of money to implement an existing standard. That's 4-5 annual engineer salaries. I'm wondering exactly how much work was actually undertook for $600k and whether those doing it (/charging for it/taking the money) felt it was unusual size remuneration.