It's not really conceptually different from relying on third party libraries in any context.

I haven't touched JavaScript since the late 90s, so I dunno what the hell's going on there, but in my C++ projects I typically have 10-20 dependencies (counting modularized Boost as one). They're either built by a custom script which includes the SHA256 of the tarballs it expects, or by a particular pinned commit of vcpkg which likewise uses SHA512 to verify its downloads.

I generally only update these when I need a new feature or bug fix, which means I'm unlikely to get bitten by any temporary security compromise.

If the "particular checkout of vcpkg" type of approach is impossible with other package managers, that's unfortunate.