It's only getting worse overtime. I have been advising devs to do more at code reviews. Every time a new package gets added or upgraded, that needs dual sign-off to justify it's use.