I dont have any experience developing for govt, so for all I know the barrier against installation of CF may be insurmountable. Have you ever tried? It really is extremely painless and would result in a net + in terms of security.
So they're stuck with IE6, because that was the latest & greatest when large custom web-based applications really took off, so they're all certified for IE6 only and would have to be replaced at enormous cost before the users can be allowed to upgrade (or install chromeframe, for example).
It's a big barrier.