It doesn’t matter if you’re, say, Debian, because they’ll just put up some symbolic “not intended for use in state X” and then continue doing whatever they were doing, but if you’re Red Hat and actually selling something like Red Hat Enterprise Linux to companies in the state, stuff like this is actually a pain in the ass.