Money, time, and perceived/realised risk of failure (to both the end user, and the supplier). Any time you have enough of those, the scrutiny will increase.
If you're making a chicken feeder IoT device, the amount of marginal QA cost you can tolerate is low (in fact, you're probably tempted to use the counterfeits...) and the only adverse outcome is a slightly hungry chicken. Medical devices have a much higher risk, but not as much money or time as military (a bottomless pit of both), so the QA level is higher there, but probably not as much as defence.
If you're making a chicken feeder IoT device, the amount of marginal QA cost you can tolerate is low (in fact, you're probably tempted to use the counterfeits...) and the only adverse outcome is a slightly hungry chicken. Medical devices have a much higher risk, but not as much money or time as military (a bottomless pit of both), so the QA level is higher there, but probably not as much as defence.