you are taking an academic security perspective but think about it from a liability / legal perspective. suppose your supplier gets breached through a well kno

you are taking an academic security perspective but think about it from a liability / legal perspective. suppose your supplier gets breached through a well known vulnerability that should have been patched by any competent vendor, e.g. log4j. you are negatively impacted and it has materially affected your business. the software component that was compromised was not in the SBOM. Now I can pursue legal action because they didn't give me accurate reporting.