Yes. The explanation given under that rather provocative headline does not mention how the OMI project being open source, as opposed to closed source, enhances

Yes. The explanation given under that rather provocative headline does not mention how the OMI project being open source, as opposed to closed source, enhances its status as a supply chain risk. Microsoft could have just as easily not released that code - it still would have included the vulnerability.