It's a fair term for supplying software to other organizations. Where there's chance for it to be tampered with between the two orgs.

The verbiage is being extended from hardware supply chain security efforts.

Yes.