What does my codebase mean, though? A normal desktop OS doesn't require app devs to issue updates for any change to any library and it would be extremely insecure to do so. The OS is better maintained than the apps.
Redownloading everything doesn't protect against supply chain attacks. Those can still happen, no problem.
Redownloading everything doesn't protect against supply chain attacks. Those can still happen, no problem.