This comment gives off the impression that bazel just wraps cargo/pip/npm invocations, which is incorrect (at least in the commonly used scenarios)

First of all, bazel does not handle any of these languages/ecosystems itself. Such logic is delegated to language-specific rulesets, of which there are multiple implementations with different tradeoffs.

For python - https://github.com/aspect-build/rules_py parses a UV lockfile and does not use either UV or pip at build time.

For rust - https://github.com/hermeticbuild/rules_rs parses the cargo lockfiles but does not invoke cargo for compilation.

For js, https://github.com/aspect-build/rules_js parses the pnpm lockfile but does not invoke npm or pnpm at build time in the commonly used configurations.

While it's true that bazel allows to patch all dependencies on the fly, in my experience many Bazel users do try to contribute back, because managing stacks of hundreds of patches across all your dependencies isn't particularly fun.