Why a recent supply-chain attack singled out security firms Checkmarx and Bitwarden