I was more concerned about supply chain attacks, along with the idea of stripping down all dependencies to truly just what you need.

Need a few math operations? pull those in, instead of an entire math lib, for example.