The plan arrived weeks after its mid-August deadline, after states had already turned to private vendors to replace federal cybersecurity support.