If they were building the stuff the people paying for the product insist they need, it seems unlikely that they'd take 6 months to use it once built. Unless it's some API that takes a ton of work to build to. It didn't sound like they were getting feedback for those six months.

Security features that add friction for the user are usually forced, aren't they?

Contract requirements do make sense, but I get the idea that this user would know that.

What are you imagining that would be actual value but not used for six months?