I really dislike when people say SBoM could help with the Solarwinds scenario, because it would not. Once the CI/CD environment is compromised, how would the S

I really dislike when people say SBoM could help with the Solarwinds scenario, because it would not. Once the CI/CD environment is compromised, how would the SBoM be trustworthy anyway?