This is about managing security risks of using OSS libraries. Many organizations end up using OSS code/libs/products without having the capability or the motivation to validate them. Google addresses some of those issues with this.