As with all definitions, there is a gray area where people will have different boundaries on exact meanings. To you - a supplier relationship needs an explicit payment, which is a fair definition.
However, the more widely used definition that most people, including me, refer to, is not necessarily focused on the supplier, but on the supply - what we use in our toolchains is a supply - regardless of how it was obtained.
When there is an issue in a trusted supply, even if it was not a commercial relationship (a prerequisite by your definition), it is a supply-chain attack by the more widely used definition.
They do. They did. What do you do when a 'good guy' is really a bad guy? Happens outside of software too. Someone inserts themselves into an organization while secretly working against its interests.
Here's a good summary. However, you should read a few articles - plenty have been going around, including on Lemmy.