Yep!

To be more specific, Open Source only promises the four fundamental freedoms (https://en.wikipedia.org/wiki/The_Free_Software_Definition).

It promises literally NOTHING else, including zero cost. Free and open source software can and should cost money! (The "free" in "free and open source" is not about money, people!)

I'm actually very enthusiastic about these OSS "supply chain" attacks that have been happening in various communities. Because optimistically I hope it'll help people realize that OSS _is not a supply chain_ (more details here: https://lobste.rs/s/cxwidw/no_one_owes_you_supply_chain_secu...). Unless you're paying your vendor AND/OR have a contract in place with them with certain guarantees, you do not have a supply chain.

One term thats in almost every FOSS license is "this software is provided with no warranty." A supply chain implies a warranty. Therefore, FOSS is not a supply chain.