Because the moment someone hits update on the package manager nothing will get updated and you won't receive potential dangerous updates you did not review first.
Edit: sorry this is not relevant to the question...
You'll then want tooling to periodically update your locked dependencies, so that you pick up fixes to security vulnerabilties. That wants to go through your CI.
Because on one hand, you do pick up hotfix patches, but on the other hand, you are possibly bit more exposed to supply chain attacks.
Any ideas on how to balance that out? Or should we just not consider supply chain attacks to be a real threat?
Sandbox your dependencies.
Run automated security vulnerability testing on your program, looking for rogue behaviour.
Require code signatures on dependencies.
Identity security critical components and audit them.
It’s a very good tip though. I must start doing this.