If something similar had been caused by an OSS component, we would see congress discussing a ban on open software in critical infrastructure already.

No we won't. I refer to HeartBleed, Log4J, and Eternal Blue, and Solar winds. None of those affected applications have been banned and never will. Congress bans are based on political aspects not technical ones.

Huawei ban is because of the ties to China, kaspersky was banned because of Russian ties.

The goal of Congress in a capitalist society is to make as much money for ~~its shareholders~~ themselves as possible.

When you vote for this, you get this, plain and simple.

People are shocked, Shocked I tell you, SHOCKED to learn this... but what else would you expect?