They also cap profits based on the original bid size. So you bid 20 million for the F35 program you get 1.5 million profit. When you overrun the 20 million to 30 million you still only get 1.5 million "profit". Typically you also have to go ask for that 10 million in piecemeal as well. I need 500k to do this and 500k to do that and the program office approves or disapproves.
Of course, the contractors probably skim a little bit off the top of the 20 million back to themselves. They might for example bill for machine team on the CNC or charge $200/hr per an employee and only pay $60 (note that they have expenses for training, downtime, office space, equipment and management which that 200/hour needs to account for so the employee isn't getting screwed that badly.
Less moral contractors might build projects which intentionally fail but meet the specifications so that the gov't needs to execute a change order at which point they would get additional fee as part of the change order, however with the DOD you can get your company put on a blacklist which will mean you cannot win any more DOD contracts. But I have heard of a California construction company doing that repeatedly over the course of 30 years successfully. In the dod world, most companies try to propose improvements to the original contract. Typically they will have yearly goals associated with submitting and winning change orders as its an easier source of revenue than bidding and winning new contracts which typically have a 30% win rate.