The physical floppies use the same chain of custody that any other part of the system use. Every floppy has essentially been signed off dozens of times before it ever sees the insides of an airplane, and there is nowhere between the manufacturer and a flying plane where there isn't a person who is officially in charge of it.

From what I understood, there is (was) a real danger of a part that was used in a stress test ending up in a bin full of spares. So every 'part' has an identifier, responsible parties, and a tagging system that keeps the streams from ever crossing. A floppy is physical, so they just did the same thing.

Imagine trying to convince a bunch of people who have always ever done things physically to use electronic distribution.