Because reliable software is difficult to produce and relevant expertise is scarce, broad software-supply-chain auditing was very difficult to achieve.

“was because of some of this physics right of kind of how hard it is to write software and to write reliable software and that everyone has the supply chain and so few companies audit their supply chain right if there's we've seen this with supply chain vulnerabilities where someone uploads a malicious package and a number of companies get hit all of that needs to change and it was totally impossible to change with human software developers because there's so few or there's so few people who have this expertise”