> Friends aren't good enough

They are if you actively manage your relationships with an eye to maintaining redundant access to necessary materiel or having multi-pronged defense strategies. Singapore is constantly nurturing strategic defense ties with multiple allies and attempting to avoid existential reliance on any single ally. And the one nation they definitely wouldn't rely on is Malaysia, the country most likely to threaten their sovereignty. Ukraine's problem was they were politically too dysfunctional and dependent on Russia defense trade until Russia's successive invasions forced them to reform domestically. (To be fair, Russia had a hand in prolonging their dysfunction.)

I think there's a lot of nuance, because the right move will depend on exactly what specific item we are talking about, combined with local factors, and this answer will vary from country to country. No country should be fully autarkic even for the defense supply chain, that much we agree on. That said, the principles that you've laid out, such as seeking redundancy, are universally good ones to follow for the non-autarkic parts of the supply chain.

> Friends aren't good enough, unless you have a mutual defense treaty, they aren't real friends and can't be counted on.

No, no, just the opposite: treaties aren't good enough. Try suing your supposed allies when they break your mutual defense treaty.. Broadly speaking (and with only some exceptions), there's no higher authority you can appeal to for enforcement of international treaties.

Mutual defense treaties only work amongst something like friends. A big part of NATO's success is because they take this lesson very serious and designed the whole system around it.