So, keyword 'rational', I'm not sure any sufficiently large company is a rational actor.

Yes, at [tech corp dayjob], any dependency is likely to be banned for arbitrary reasons if you bring it to the attention of the wrong people. It doesn't have to go against any of our policies e.g. don't mention anything with GPL in the name around the "risk" people. In fact, do not ever talk to the "risk" people and hope they don't talk to you.

Latest news: Apparently, devtools are a legal risk. Basic reverse-engineering of client-side JS is now banned.

The delusions really seem to scale with headcount.