Comment by matbanik

The real vulnerability isn't the supply chain, it's the muscle memory of running install and update reflexively without reading what changed.