To give some context here, I currently work on SDLC and dev security. Supply chain attacks are high on the agenda right now. I don't have a problem with this

To give some context here, I currently work on SDLC and dev security. Supply chain attacks are high on the agenda right now. I don't have a problem with this set of recommended practices. And that's all they are. These are things to consider and only constitute guidance, which may be out of date. It says all this in the intro.