[ashrk]

There's also the matter of difficulty keeping up with which products are tied to which bad actors, possibly far up their supply chain.

Distributing responsibility for determining which companies are being ultra-shitty but not breaking the law imposes far too much time-cost on consumers to be reasonable, on top of the regular costs of participating in boycotts. They're not an effective means of enforcing society norms. Regulation is—making being ultra-shitty illegal works way better than imposing a cost of ((time it takes to keep up with and track shitty-company news)+(cost of participating in boycotts)) times (number of consumers) across your entire society. That's clearly untenable and it's not really the fault of individual consumers that boycotts don't work for enforcing social norms, since they can't really work, in the general case, once your economy scales past the local cottage industry level. It's impractical in a global, or even national economy. Then there's game-theoretical pressure to defect from a boycott, et c.

Even the highly-engaged consumer will catch and (weakly, ineffectually) punish maybe single-digit percentages of the awfulness occurring in their economic footprint, at great time and probably monetary cost, unless they check out from the economy almost entirely.