IAAL, and that is a good question. (This is not legal advice.)
CRFA appears to apply to contracts that bind an "individual" and not a "person". This technical difference is important in contracts: an individual is also known in the art as a "natural person" (i.e., a human being), while a "person" could be an individual, a company, or other organization.
So it is possible that the law does not apply to Orca Security because they are a "person" and not an "individual". In other words, if it can be found that Mr. Shua was acting as an officer or other representative of Orca Security instead of in his personal capacity, then CRFA may not apply to the license agreement.
Again, this is NOT legal advice, and anyone seeking a legal opinion should engage a licensed attorney. This law is pretty new and I don't know whether this specific question has been tested by any court. But I would tread with caution.
I would be extremely surprised if the CRFA applied to competitors (or generally to corporations). The first word is "consumer", and competitors are generally not consumers of each other's products.
If you are correct though, doesn't that make Oracle et al's "no benchmarks" stipulation non-enforceable as well? That would be kind of nice.
