Log4Shell wasn't a supply chain attack, though; it was a genuine bug in a widely used library that had become a de facto standard, even in an ecosystem that tends towards relatively smaller and shallower dependency trees. So that comparison doesn't seem apt.