Interesting, I'd more likely assume the same for closed source projects as there is less transparency into the supply chain