This is so true, and it’s true of libraries, OSS, etc. I frequently build instead of using a library simply because I’ll know and can fix the warts, I’m automatically in tune with the state of the code, and I’m in control of maintenance. Of course if the code is too big (TLS library like OpenSSL) then it changes. But I still try to avoid external stuff just because of the costs you listed.