Sure, but here I guess the main idea is that everything is linked, especially how libraries package managers work nowadays.

In order to compromise the big player, you only have to compromise the weakest link in its supply chain. In effect that means that leaving the migration optional is as useless as doing nothing.