"If a supply chain attack succeeds against a closed business like Apple or Google, even discovering it is there at all is wildly difficult for third-parties, and fixing it is effectively impossible."
