I would expect an operating system and a single application have a different approach to dependency management.

Debian is both an operating system and a distribution of single applications. Its (excellent) dependency management applies to both. It doesn't have a software supply chain problem because it takes dependency management seriously.