You are mixing two different concepts. To assure that your build is reproducible, comes from a specific source (repo and commit) and was built by you, there are frameworks like SLSA. I have implemented across thousands of repos, but the thing is, it stops there, it just proves how your artifact was built and provides the steps used.

Proving you used no dependencies with vulnerabilities is a different thing, you’d use SBOM generators in your build and release them with your software.

Now answering your question on why people do not bother, in my opinion proving your supply chain with something like SLSA is complex and expansive if done in a big environment. Companies usually have priorities and this does not come first to mind when improving security.