It is required by law. Most likely through prohibitions for "exporting" defense technology, which can be very broad. "Exporting" can consist of having a casual conversation with a non-"US Person" or having a document visible on your desk.
"Secret" classification is really mild, about 5 million people have one.
>The law prohibits employers from hiring only U.S. citizens or lawful permanent residents unless required to do so by law, regulation or government contract.
At these workplaces it will be a combination of all 3 of law, regulation, and government contract.