I'm pretty sure you (and others) are trying to apply some kind of guess at the "supply chain risk" designation, but it means something specific.
Here's the term defined in an official context:
https://www.acquisition.gov/dfars/252.239-7018-supply-chain-....
That link is broken for me but I assume you meant to link to [0]. I think if there is a “safeguard” in a system, that definitely fits the bill of a supply chain risk. The only vague term here is “adversary”.
[0]: https://www.acquisition.gov/dfars/252.239-7018-supply-chain-....
404
Since the link is still broken, I tried encoding the final dot as %2E
https://www.acquisition.gov/dfars/252.239-7018-supply-chain-...