Comment by pjmlp

In principle the guy that sells the software, that is why now SBOMs (Software Bill of Materials) are a thing in security assessments.