'It may sound obvious but the primary way we reduce the risk of supply chain attacks is to avoid depending on third-party code."

What a horribly disingenuous statement, for a product that isn't remotely usable without 3rd-party plugins. The "Obsidian" product would be more aptly named "Mass Data Exfiltration Facilitator Pro".

I've used Obsidian for years without a single 3rd party plugin.

It is possible to make your same point without histrionic excess.