Can a high-performing supplier still be a high-risk supplier?

Something I kept seeing during years of working with supplier quality and development:

A supplier can have good quality, strong delivery performance and competitive cost — and still represent significant supply risk.

Single-site dependency, capacity constraints, financial weakness, sub-tier exposure, compliance issues or geopolitical risk may barely show up in a traditional supplier scorecard.

Which raises a question I think is worth discussing:

Are traditional supplier scorecards really measuring supplier risk — or mainly measuring past performance?

Curious how others in procurement, quality and supply chain approach this distinction.