There's probably a handful of functions in lodash that are still useful but why take on the security risk and maintenance of another package dependency if you can just copy a couple ten-liners into your own utils folder? It's not like the world is going to come up with a more performant debounce anytime soon.
I guess lodash also relies on jquery which is in the same boat. es6+ has stolen a lot of its thunder and target-aware transpilation is a better approach to cross browser support