Attribution in security is really hard. But attribution in health supplements is far harder. Nobody's ever gotten a PoC for a health improvement to work every time in living organisms, even on the same organism version and platform. So there isn't a real option for supplement producers to make quantitative claims about their efficacy.

Meanwhile, quantitative, money-linked claims about software security actually do happen in rare edge cases, already.