Correct (and secure) code is possible and readily doable. It is unclear if supply chain attacks can ever be fully mitigated.