Counterexample, and the reason why there is so much emphasis on 'software bills of materials' and similar stuff recently: Log4j. Fully open-source, packaged by

Counterexample, and the reason why there is so much emphasis on 'software bills of materials' and similar stuff recently: Log4j. Fully open-source, packaged by many, many open-source (and closed-source) vendors. Had a widely-publicized series of terrible bugs which caused billions of actual losses, as in: "we had to pay to get this remediated and/or had to shut stuff down for a while, and that made us look bad, without anyone to sue." Reducing that to "let's get rid of insecure, proprietary software" is a take, but not necessarily an accurate or helpful one...