Yes true but have you audited your thousands of modules? If you have a build tool that wasn’t born in 2020 chances are it pulls a hundred dependencies from 20 separate vendors.

I saw this as a JS developer who scarily runs npm installs multiple times a day.