Which is very different to labelling them a national security risk instead of just not awarding them contracts.
I don't know what analogy would drive the point home. Imagine a password management system where the people running the company have an ideology that leads them to believe that their system should not allow anyone to secure anything used in military applications. Well, that's a security risk. And no contracts should be granted. Cause and effect. There's no confusion here.