This is good history.

While Gradle, Bazel, and SBT responded with relatively swift and thoughtful fixes, Maven proved to be a far harder challenge.

To me, “Apache” is synonymous with insecurity. I know many will downvote me for this comment, but there is so much just shockingly bad security associated with Apache including struts, log4j, Apache http server, Apache commons, tomcat, etc… it just goes on and on, and yes everything has vulnerabilities but the ones coming from Apache are always shockingly bad design choices because security was left as an afterthought.

Another point is that for a long time, Maven and similar were pushing for got signatures on repositories to eliminate threats like what was discussed in this article. I had a huge rant on StackOverflow about why this is so wrong long before people were talking about supply chain attacks. Over time, Maven seemed to stop talking about such signatures as the solution. Signatures just shift the problem to somewhere else. Hopefully SLSA will eventually give us a safer way of verifying artefacts but only if it becomes the norm for open source software which remains open.