I don't have a source unfortunately, this is mostly internal directives from my work within NIH. I've had many conversations with security officers and IT about my plans to use local models for various projects, and hackles were always raised in regards to Chinese models.

I also did a short stint with an IT operations company, and we were told Chinese models were a no-go as well from our deployments on DoD hardware.