> How would transitive dependencies be handled?

Have a SBOM format whose license requires truthful reporting (or the license is null and defaults to open source), then trust only those SBOM formats with this property.

Taleb's minority law will do the rest. Pretty soom, most SBOM formats will adopt this rule.