SBOMs should be connected with vulnerability databases to fulfill their promise of reducing risk, Google security team says.