Google has the team + tooling to properly support it. The same cannot be said for many other orgs.
Every problem you could have with bad dependencies is entirely self-inflicted. The Right Thing™ is to choose a known-good version, and update when you have the bandwidth to pay down the tech debt.