You need to look up what a supply chain attack actually is.

This is not necessarily malicious behavior nor incompetence, unless you consider putting ads on a website incompetence. This problem has been festering for well over a decade.