Understanding the relationship between FOSS and the “software supply chain”

I'm reading* The Phoenix Project and the parallels it draws to factory manufacturing is inspiring.

The point being, imagine being a car manufacturer and using parts from an unvetted vendor, a vendor that has not passed some sort procurement criteria. That would never happen, eh.

Yet, software factories do it all the time.

https://www.amazon.com/Phoenix-Project-DevOps-Helping-Busine...

* Perhaps the best book - so far? - I've read via recommendations on HN.