Once a dependency turns into a security vulnerability, you can either replace it, or write your own library like I suggested. It's more cost effective and time efficient than writing your own libraries from scratch for every project.

For example, I'd rather install React Router for routing in a React app instead of writing my own routing library. I guess some people will reply "grrr React, just use static HTML bro". Okay cool.