They’re burrowing into every data system in the federal government, although many wouldn’t pass a security test