I was talking about total deps, not direct. By installing something like Celery, you get 8-10 extra dependencies that, in turn, can also have extra deps. And yeah, extra deps can conflict with each other as well.
You just keep up as you go, as long as you keep things close to the framework it's fine.
He said "Updating a project that was started 5-6 years ago takes a lot of time."
The answer is the same in both cases: acquire some discipline and treat maintenance with the respect it deserves.