Aparently not true.
https://hackernoon.com/im-harvesting-credit-card-numbers-and...
https://hackernoon.com/im-harvesting-credit-card-numbers-and...
His section about circumventing CSPs was particularly interesting and relevant. CSPs were an impediment to him, and he avoided operating his scam on sites where a CSP was installed.
It really isn't normal to have 1000+ dependencies and it really isn't safe. Just saying "CSP will protect us" isn't good enough.
I do. That is why I don't have many deps in general. Transitive or not. With only a handful of dependencies that are from trusted sources and that are audited by me I can be sure that they are safe.
With 1000+ dependencies that are from as many random sources you can not do the same.
Having 10 dependencies is drastically different from a security aspect then 1000+.