On the one hand there is 100% validity to what you say. On the other, people download entire trees of dependencies from pypi, npm, homebrew, independent non sandboxed apps, chrome extensions, etc.

So don’t lull yourself into thinking the supply chain on everything on your system is any better :) It’s likely substantially worse.