Generally this is an accurate take. I'd add two things:

> ...because they're realised they really have no idea of their exposure.

This is partially because it is often non-engineers being asked to figure this out. The "information security analysts" at F500s are asked to do a lot of unfair work, such as analyze risks related to decades-old software they didn't build.

> ...there's a whole business ecosystem in just being able to answer that question let alone do anything about security issues.

The first part (answering "what dependencies does my software have") isn't inherently bad. I'd emphasize the underinvestment in the second part more.