To me the Equifax story is the Nth such story that points out a crying need for a better security model. In 99%+ cases single teams can no longer produce 100% of the code that companies rely on. Most teams do not have (or can not afford to hire) people with expertise to audit or even an ability to understand the implementation details of the third party codes they use. Consequently any 3rd party code should only be allowed to access resources or data structures that it absolutely needs to carry out some work on behalf of its caller. This is separate from managing the scale complexity of s/w dependencies.