"Supply chain risk" specifically refers to risk of malicious attack or sabotage through the supply chain, not all risks associated with supply chains.

A vendor with particularly poor QA might be a risk in your supply chain but isn't a "supply chain risk" according to this designation and neither would Anthropic be.