Who has read through all the code of their direct dependencies, let alone transitive ones?