“And then why attempts at bringing FOSS under that definition are deeply misguided.”
A supplier has a contract and gets paid. The volunteer who maintains your JSON library has neither. Companies want supply chain guarantees from people they never paid. You can’t audit a gift. If you want a supplier, sign a contract and pay one.