It is pretty much the way that I look at things. It was also the way that the company that I worked for, did things.
They would never have blindly relied on some outside supply chain. In some cases, we were only given opaque binaries to add (licensing/contract stuff), but we checked that binary into CM, and it was part of our product.
Testing, calibration, accountability, etc., was all on us. If the vendor software failed, it was our failure, and we were Responsible for fixing it (which may have consisted of frantic calls to the vendor).
We also did not add any free software. Indeed, we actually paid a company beaucoup bucks, to scan our software, and let us know of any unlicensed software.
It was really important to establish full provenance of every line of code in our products. We had good lawyers.