'yes, you should' needs to be reconciled with 'it's f*g expensive' and 'risk is low'.

nowadays, 'risk is low' isn't true anymore and it's actually cheaper to have a robot spit out a reimplementation of the 5.4% of what you need out of your dependencies instead of auditing the 100%.