True, but that is beyond my control. I am not evaluating every package within a dependency tree unless something happens, out of practicality.

I have limited time on this Earth and at my employer. My job is not critical to life. I am comfortable with this level of pragmatism.

The same response applies to the dependencies that you choose.