That was my assertion, I said the surface for attack included supply chain. As another poster pointers out, that is in fact reduced under some circumstances, since the runtime context is browser side.