About software supply chain attacks and FOSS software:

There is a small problem here. We are not suppliers. We do not have a business relationship with all these organisations. We are volunteers, writing code and putting it online under these Licences. And yes, we put it online for people to use them. But we do not get anything from it.

[With the MIT licence, maintainers] do not have a business relationship with all these organisations. [Maintainers] are volunteers, writing code and putting it online under these Licences. And yes, [Maintainers] put it online for people to use them. But [Maintainers] do not get anything from it.

To get a supplier, you need to give people what they need to live and they have to agree to these terms.