Supply chain risk ensures nobody in the chain is buying it and thus becoming subject to Antropic's demand of usage control. They are still free to use it for non-DOD purposes, but if Antropic wants control over DOD, DOD has the right to say "no, we won't have anything to do with you, and thus you're not getting any control over us". I agree it may be unpleasant for Antropic but DOD has the right - I'd say even responsibility - to not submit to control by any private party.
No, it's not. If Anthropic is a supply chain risk, that means that if you are working on a project that will be used for the DoD, you can't use Claude or any other Anthropic product for any purpose whatsoever in that project. Asked Claude to change the color of a PPTX for a sprint demo you're doing? Oops, you've know introduced a supply chain risk and your company is liable for damages or at least losing its entire contract with the DoD.