> I have not heard many companies really conceptualize their “supply chain” exposure from the myriad of scripts/dependencies injected via tag managers and other software.

I made a thing called "TrackerMap" that allowed people, mostly Fortune 500 web/risk/compliance people, to do just that: https://www.crownpeak.com/products/monitoring-solutions/tag-...

(It has since been acquired, and I have no affiliation.)