Often, ridiculous and onerous procedural security is hiding massively incompetent actual software security or is used to constrain people from discovering security by obscurity holes. Everything I've done in government interfacing as a vendor would seem to confirm this, at least back when I was doing it a few years ago. You'd be hard pressed to convince me it's changed much since.

I once answered a phone call inside a com closet on base. Military IT was already escorting me. Security came because the cameras in the closet detected the camera on my phone. It's definitely physically tight security.

That said, I’ll take what you said on faith, because I think you’re spot on with everything else.

I mean, it's not a secret that governments everywhere run really outdated software (think things like Windows 7 and older) because "it works", so it really shouldn't be too surprising.

I had to help the SSA implement SAML authentication once and they weren't even allowed to share their screen so I could see what they were doing. Totally agree that it's a massive chore.