I don't think transitive definitionally means we can ignore it. Any input that I give to my direct dependencies could theoretically end up inside of its dependencies and I can't know that it doesn't without auditing the source.

The actual split is on which environments the dependency exists in and who can control inputs in those environments. For most private companies who aren't running CI on an open source repo, the dev/prod split is the operative one that determines what you can safely ignore.