Personally I think this is a symptom of the "you own nothing" Software as a Service delivery model these days. Businesses love it because instead of multi-year capex expenditure they can just pay a monthly fee for what they use to a company that hosts, maintains and updates these components for them, ostensibly for free (of course it's not free, but it's a lot cheaper to provide at scale), and often for less than the equivalent on premise service.
This is one such platform - in fact, it is the only method of delivery for this product. It is "born in the cloud".
You place a lot of trust in these companies and this is exactly where the supply chain risk comes from. In some cases (eg SolarWinds) those updates may have been thoughtfully provided by someone other than who it should have been, right into the guts of company IT systems.