I don’t think SBoM is solved by Open Source necessarily. It makes the problem easier maybe, but it doesn’t really solve it.

If you want to use Open Source code in an environment, it is necessary to validate all of the code (or know who validated it), including all the dependencies. The maintainers don’t have any obligation to help you, and it is a tedious job that they might not be interested in (or maybe you are in the policing or defense sectors any the maintainers find your application objectionable).