Lockheed Martin, Raytheon, General Dynamics and Northrop Grumman are almost entirely (if not entirely) focused on work for the military. Boeing has lots of their own commercial stuff, but they also do work for the military. The work these companies do is pretty broad. They can make fighter jets, but also custom software.
The military tends to get funding for certain projects, and then seeks out contractors to research, build or manufacture things for them. In some cases, they may split budget between multiple companies or organizations. The military tends to select companies or organizations with demonstrated expertise in a project area.
I was on a DARPA project, and when DARPA announces projects, you have to apply to be selected. The money from our project wasn't funded by DARPA directly, but rather via the Air Force Research Labs. All of the companies or organizations that were selected for the collaborative research team I was on, were experts in some privacy-related area (usability, data storage, AI, differential privacy etc). I worked for a big-name university which was awarded a contract, and we were held accountable for how we spent the money. Keep in mind, congress keeps an eye on these budgets. We also didn't strictly do research, we were expected to produce something tangible and had to put in an honest effort to transfer the technology to the public.
So when you talk about startups and VC funding, I can't imagine there are too many (if any) of those kinds of companies around. A VC is going to invest in a company, because that company is producing a product that is going to get them a return on their investment. If the government isn't awarding contracts to your startup, then you aren't making money. Think back to SpaceX vs Blue Origin, and how much money Bezos lost on that NASA contract. One of the companies I worked with that gets awarded DARPA money was started by an ex-DAPRA project manager. They had connections. Other companies who did contracting work for the military were well-established and have a track record of delivering quality. You just won't really see college-aged kids come out with an idea for defense, get a ton of VC money and then start working with the government. Chances are more likely that they will build some product that has relevancy to the government, and thus the government becomes a sort of side-customer. College-aged kids just aren't really established enough to be taken seriously for these kinds of things. They may get to work on those projects during the course of their research at university, though.
For things like limitations on research, as mentioned above, you will be awarded a research grant for a specific project. Your limitations are scoped to that project. The military (DARPA in this case) could hypothetically decide a particle disintegrator is worth researching, and then call for people to apply if they got funding for it. You will see companies and universities applying for this work. DARPA project managers tend to be experts in a specific area. The project manager for Brandeis (the project I was on) is an expert in cryptography. So you won't see random people coming up with random ideas. The project managers have to come up with a project that is worth getting funding on, which isn't easy as I understand.
For legal stuff... one of the organizations on the DARPA project I was on ended up developing technology that the military decided to keep secret. I don't know if those individuals ended up getting a security clearance or what, but they weren't allowed to discuss the work with other team members who weren't involved. Typically a contractor will want to see US Citizens and ask that they get a security clearance, but sometimes there is work that doesn't require a clearance. As mentioned in another post, you do have to consider laws like ITAR especially if you start using HTTPS and other encryption methods. If it is a DARPA project, there shouldn't be any "legal" issues that randomly prop up. They keep in touch with you, so unless you keep things a secret from them, that shouldn't happen.