FIPS is a US government security standard: https://en.wikipedia.org/wiki/FIPS_140

It doesn't have much to do with this CVE, but if you're trying to sell to the US government, it will often be a requirement, which means that a company making money from those sales will not easily be able to move to a distro without that certification.