You can't stop the problem at the source either. Good software goes bad for lots of reasons: classic supply chain attack, ...