I imagine that the company would have the burden of proof that any of these criteria are fulfilled.
Third-party rights most likely refers to the use of third-party libraries, where the source code for those isn’t open source, and therefore can’t be disclosed, since they aren’t part of the government contract. Security concerns are probably things along the line of “Making this code open source would disclose classified information about our military capabilities” and such.
Switzerland are very good bureaucracy and I trust that they know how to make policies that actually stick.