The problem with the latter has always been the same. It requires careful review to ensure that system boundaries aren't being crossed. It's very obvious if your repo sounds to access to a new database. Less so if it imports a function directly from an inappropriate package.