I rather refer to software development case when you have multiple open source dependencies in your project and one day one of the dependencies becomes controlled by an attacker

In case of a web of trust it may mean one of your friends becomes the attacker, or they are sold to an attacker or they get hacked by an attacker etc