GSA products sales aren't so bad, and sometimes services are incidental to product sales. If I were a lock maker, I'd sure want to be Kaba-Mas or S&G with a decent amount of government sales. If you have to provide some services, it's not horrible -- it's a $200-400k/yr living for a few consultants if you're in the right space, and generates nice revenue for the company, without taking over the focus. If you're an independent contractor and end up subcontracting to a product company, you can make really good money filling this role. If you don't have to do the "get the product sold" phase, and are purely subcontracted to the the implementation/support, it's actually not bad, and not very different from enterprise clients in general. There is the problem of single-client-all-revenue, and some slightly odd work rules, but enterprise often has that.
I share your moral concerns about vuln research/etc. for the government, but I have no problem with defensive tech for them, or for non-security tech.
That's a rule that has served us in pretty good stead.
It's not just the moral issue (though I do have dealbreaking moral problems with doing the kind of work I do for the USG) but also that the market for GSA-style services is so different than the regular market; not only is it harder and weirder to address as a market, but also succeeding there doesn't teach you much about how to make your offerings work in the real market.
(I've worked, earlier in my career, on somewhat large-scale projects [not in vuln research] serving government agencies, but have never been a principal at a company that targeted government sales, so, grain of salt or whatever).