Yes, that is how it works. Lockheed Martin isn’t a governmental body within the United States and is not bound by our Constitution in any way.
Regardless of our opinions on the matter, those are both private companies with their own rights that are not bound like a government under our current laws. People forget that because “corporations are people” they also get Constitutional protections. Our rights end where their rights start and vice versa.
There’s nothing wrong with OCI Images. If you’re concerned about the security of Docker (which, imo, you should be) there are other container runtimes that don’t have its security tradeoffs (e.g. podman).