My React project has 1,015 dependencies (directories in node_modules). If I didn't have locked versions then every minor automatic update could bring in more dependencies without me knowing.
Can anyone honestly say they've done such due diligence?
That seems doubtful.
And that's a real and potentially serious problem, because IP laws typically don't contain any exemptions for code you're using that infringes someone's IP rights just because it was contributed by a third party.
That said, the amount of dependencies you have locally installed is likely to be a multitude of the number you'd get if you'd exclude devDependencies, which I'm guessing don't count.