True but supply chain attacks are real. A good security plan needs multiple layers, this seems like a good one to include.