In a way, having a 1-2 year manufacturing plan can be like pre-selling many still-discrete still-not-in-hand components in advance. In other words, short-selling.

Your BOM can be 1000 vulnerabilities to a focussed short-squeeze.

I suppose this is a predictable and reportable business risk.