The supply chain attack is not the only argument here, though. For instance, who effectively controls the ruby ecosystem? See ad-hoc restrictions such as 100.0

The supply chain attack is not the only argument here, though. For instance, who effectively controls the ruby ecosystem? See ad-hoc restrictions such as 100.000 downloads - past that point you are disowned from your own gem. I always felt that was a direct attack on independent developers. They could have forked those gems just fine (the licence permits this for most gems after all), but nope, they forbid you to remove your own (!!!) code.