If you aren't auditing your dependencies, you don't know security. But we don't do that either, we outsource it.

This a reasonable thing to outsource: let someone qualified build their own.