Real talk: the real "supply chain risk" is that you treat your open source "supply chain" like shit and assume that we will all take any amount of abuse from you and just keep doing volunteer labor forever without ever complaining. And, equally real talk: most of us—myself included—actually do love the process and the community so much that you're right, and there will never be any real consequence.
But not all of us.