On the level of practical risk: on the security level libraries are much more risky imo. A good framework for most project i've seen will lead to a more structured and secure codebase. Probably precisely because there is less room for creativity.

For instance Laravel is very structured: orm, auth routes, controllers system etc., where express.js let's you do whatever.

And almost all Expressjs or other Nodejs projects i've joined were a mess and had security issues, something as simple as CSRF tokens, or not allowing redirects to external domains, are often forgotten or not fully implemented.

Doesn't mean I don't sometimes prefer a library approach, but the developer(s) need to be a lot more qualitative.