The reason it is deemed a security risk, is because the USA government can demand any data from any American company. Hence the USA would be able to demand some of the most personal data of all Dutch citizens.

I am unaware of the defence contract, but there is a good chance that this same risk is not a factor there. For example: hosting NATO data, or providing software solutions can both be done without this risk being a factor.

I’m not saying that the defence contracts are smart or devoid of corruption. Just that the risk that was introduced here may not be a factor.