Ongoing vulnerable Log4j downloads suggest the supply chain crisis wasn't the wake-up call it should have been.