Any supply chain attack can be done in ways where it's externally impossible to (automatically) differentiate a malicious change from a intentional change.

Which means BOM's are 100% guaranteed not to prevent supply chain attacks.

At best it makes them a small bit harder.

Software BOM's can have some small benefits, but preventing supply chain attacks is not one of them. And open access to source always is much more useful then just a BOM.

And like a BOM without signature isn't that much trust able (with closed source) accessible source without signing is not trusteable without reproducible builds.

Anyway signing source code isn't hard so no reasons not to do so, signing build artifacts can be harder.