10 USC 3252 has only been used once, against Acronis AG, a Swiss company with Russian connections.

Acronis did not have DOD contracts.

Other companies (Huawei) have been deemed risks under different laws, or by Congress, but they also didn't have direct DOD contracts.

Do you have any evidence for your assertion? Did you check if it is true before posting?