The world would have to be aware of these attack vectors and attack tactics to be able to mitigate them. That's not to say they haven't existed in concept for the last 10 years (which many have), just that very few utilized them maliciously until the last few years across the industry. (Also see the exponential increase of supply chain attacks in the last couple years alone and the vector/tactics used)
Security tends to be a cat and mouse game in my experience. If you wanted to even go down the Sun Tzu perspective, the best defense is to subdue the enemy without fighting. That allows one to understand the strengths and weaknesses of one and their enemy and to develop a defense that is flexible and adaptable to the moment and harden it for the future.
We download code
From the internet
Written by unknown individuals
That we haven't read
Which we execute
With full permissions
On our trusted devices
Where we keep our most important data
We trust that there has been a testing process that validates that things do what they say they will do. Admittedly when dealing with non-OSS vendors you can sue them if something goes badly wrong.
The issue is rather that this is only a largely collaborative one. Which makes the thing kind of worse, because you can _often_ get away with simply trusting everyone and there are economic and practical pressures to do so.
We're working on making it similar to email spam. Will post more soon. Meanwhile, we welcome changes that can make it less noisy for the community.
[Edit:] one can specify Github API token to get around rate limiting. We'd deeply appreciate if could create an issue for this on the repo.