A software bills of materials standard gets an update, but while half of firms require the manifests, the driver is compliance rather than security.