If this is just the standard CMMC clause getting inserted with all government contracts, then they are not actually required to meet all the security standards

If this is just the standard CMMC clause getting inserted with all government contracts, then they are not actually required to meet all the security standards all at once. They only have to have a plan to meet all the standards. So saying that you are compliant when you aren't here is not a requirement for a contract. It's just lazy.