Which is just another example of why you should always complain about "national security" refusals: because NZDF's decisions are clearly suspect and self-serving and need independent external review (in fact, this goes for every other reason they cite for refusal as well). The Ombudsman's review may be weak - like the courts, they tend to be overly deferential when the words "national security" are invoked - but it will in theory force NZDF to provide some specific justification, and might embarrass them into changing their practices slightly.
The best way of preventing such patterns of dubious decision-making becoming established would be for regular, random audits of past decisions. The Ombudsman can in theory do that already (except for police and Ministerial offices) using their existing Ombudsman Act inquiry powers. Weirdly, it does not seem to be part of the Ombudsman's irregular series of "practice reviews", which mostly look at policy rather than actual practice. Maybe that's something they should look at.