It still has a ton of rough edges like error messages still closer to a stack trace than something actionable and it's slow as hell resolving but it does the job 90 percent of the time without issue.
Also running everything in docker now anyway which side steps some other problems.
We trade security for speed(or "velocity" if you want to be jargon about it).
I just pin everything and go through my projects every couple weeks and bump the deps (unless some really big CVE hits the news).
I know Go has historically done something interesting with selecting the "minimum viable version number" for each dependency, but that's the only relevant idea that comes to mind.
With PyPi, at least it's relatively trivial to self-host a pypi instance and self-manage dependency updates.
In the Python ecosystem (vs e.g. Node), at least the total set of first+second-order dependencies for most normal projects is quite small (e.g. medium double digits to low triple digits). It doesn't feel too painful to manage that magnitude of upgrades on a monthly or quarterly basis.
It seems like the shortest path to a universal package management tool for Python is to add this capability to Poetry, rather than to build something new.