Adversaries are adopting a more precise approach to supply chain compromise. Organizations need to rethink what “secure software” really means.