Eh, that only took a few dozen actively exploited supply-chain vulns in the span of two years!
Only took Microsoft themselves getting hit with it for things to change.