what is the difference between these two things from the point of view of how much work you have to do?

- checking every update of every dependency to see if is a relevant urgent security update

- checking every update of every dependency to see if it turns out to be a supply chain exploit

am i still checking every update of every dependency? there's no heuristic here. either you check them all, or you get randomly exploited - either by using known vulnerable software or from supply chain attacked software.