I don't see how that follows.

uv doesn't exactly stop python package supply chain attacks...