The argument "all these vulnerabilities in other people's technology that we depend on have really simple fixes, so we don't need to do anything" is not a compe

The argument "all these vulnerabilities in other people's technology that we depend on have really simple fixes, so we don't need to do anything" is not a compelling one for most businesses. If solving supply chain attacks from package managers is a simple security problem for you, you could make a lot of money though!