Don't let us forget, also, that the ISO standard is not restricted solely to physical product and manufacturing (at last count, 40% of certifications were issued to service organisations).
'Customer-supplied property' can cover a whole range of stuff, from intellectual property, to electronic data and confidential information. And 'reporting' something to a customer as unsuitable for use can be as simple as phoning/emailing them to say 'that file/data you sent us is corrupted, can you send another please'? And taking due care isn't necessarily 'reporting scrap', but may be related to how the organisation manages control to its IT and network, and / or how it stores data.
You wouldn't, for example, want to have the situation where a bank supplied real data (of real financial transactions for its customers) to a software house in connection with the development of a software system, and someone just chucked away the print-outs of said confidential data in the waste paper. And somehow, they escaped from the dump bin and were found blowing down the local streets. Where they were found and passed to a newspaper, which of course wrote an extremely damaging newspaper report... Can't happen? It did.