I don't have a source unfortunately, this is mostly internal directives from my work within NIH. I've had many conversations with security officers and IT about my plans to use local models for various projects, and hackles were always raised in regards to Chinese models.

I also did a short stint with an IT operations company, and we were told Chinese models were a no-go as well from our deployments on DoD hardware.

General guidance we’ve received for deployment on protected gov’t networks the past few years has been any open source, whether software libraries or models, won’t pass security review if there are substantial contributions from Chinese/Russian/etc. nationals. There’s even an exceptions list for “well known software” where there are vetted versions for deployment (nginx).