The rules of cybersecurity:

1. Under no circumstances should you own a computer.

2. If you absolutely must own a computer, under no circumstances should you connect it to the internet.

3. If you absolutely must connect it to the internet, it’s too late and they already have you

Like most supply chain attacks, it’s targeting developers and other people who use tooling like this rather than Bob and Alice on the street.

That doesn’t make you safe from supply chain attacks generally. There’s no reason a supply chain attack couldn’t be applied to software repos you do use if a vulnerability exists within them and a bad actor is sufficiently motivated to exploit it.

Noted, totally_not_a_gun_pinky_promise.stl will print just fine

Piracy is a service issue, plain and simple. It would be all but dead if media companies gave their customers what they actually wanted, but line must go up at the expense of literally everything else.