I really dislike when people say SBoM could help with the Solarwinds scenario, because it would not.

Once the CI/CD environment is compromised, how would the SBoM be trustworthy anyway?