I've worked in IT consulting for over 10 years and have never once lied about the capabilities of a product. I have said, it doesn't do that natively, but if that's a requirement we can scope how much it would take to make it happen. Sadly my company is very much the exception.

The worst I saw was years ago I was working on an infrastructure upgrade of a Hyper-V environment. The client purchased a backup solution I wasn't familiar with but said it supported Hyper-V. It turns out their Hyper-V support was in "beta". It wasn't in beta. They were literally using this client as a development environment. It was a freaking joke. At one point I had to get on the phone with one of their developers and explain how high-availability and fail-over worked.

eh DHCP isn’t really important right? obviously if it hasn’t changed since the 80’s why would you need to reboot your server.

what are vulnerabilities?

Promising features that never existed is part and parcel to a lot of software sales, whether gov or private. Speaking from post-sales experience.

The contractor I worked for was run by a man who used to say "if the contract says they'll blow up the contractor on delivery, we're putting in a bid and solve the problem later"

I worked in government contracting (and government, for that matter) for years and that blows my mind. I can't remember the details, but if you even had a bad reviews, much less being found noncompliant, it could disqualify you entirely from some contract vehicles for a matter of years. Wild that there's some agency that somehow lets people get away with fraud.

Also, if that cost the government money, there's a chance you could report that after the fact and make some money.