Debian is both an operating system and a distribution of single applications. Its (excellent) dependency management applies to both. It doesn't have a software supply chain problem because it takes dependency management seriously.