If you read the next two sentences it makes it fairly obvious that this is a plan to indirectly target suppliers. Federally funded researchers will be required to

"procure synthetic nucleic acids and benchtop synthesis equipment from U.S.-approved suppliers. Those vendors must verify their customers’ identities and screen orders for potentially dangerous sequences that, for example, could encode toxins or pathogens."

If this was just about feds self-policing, they wouldn't have the customer identity requirement.

Probably they're taking this route because AI is moving fast and Congress moves slowly.