An SBOM answers a plain question: which components and licenses sit inside this artifact. Generate it to trace and audit — archiving a file is not the same as being secure.