The DoD is empowered to determine its own supply chain risks by...wait for it...legislation.

They don't need to - there are alternatives, and do you really want to do business with a supplier that is hostile to your needs unless you have to?