A problem that C solves by simply not having a supply chain! You can vendor dependencies in Rust just as easily as you can in C; far easier in fact thanks to `cargo vendor`. Cargo won't review them for vulnerabilities though, you'll still have to do that yourself.

It does, the package systems of C evolved alongside the OS, so they are now the OS package managers and also cope with all other language mangers.

C (and C++) has a supply chain. It's called unpaid Linux maintainers.