> The idea that say a startup has time to audit every line of every dependency is absurd. Even a big business can’t do that.

Big business absolutely do that. Code quality review, security review, legal review. Every line of every 3rd party dependency.

Of course, for the most part big business doesn't take 3rd party dependencies. If you have a big enough software org, you write everything above the std library in-house. Why do you think so many of the big open-source frameworks are vended by big 10 tech firms?