> For example, the bill would require [...] that vendors ensure the devices are free from known vulnerabilities when sold.

This seems... logistically challenging. It kind of also seems like an invitation to release new, high-priced "only the government will buy these" devices frequently, since (a) new devices don't have known vulnerabilities yet, and (b) older devices do have known vulnerabilities, so the government won't be allowed to buy them. But the security of those new devices will be much worse than the security of older ones.