Security is more of my concern: these things change constantly and versions can even be completely replaced, so even if you convinced someone to do a full security audit (and they checked all the dependencies of the dependency, etc. etc.) I still don't think I'd feel entirely secure.

> checked all the dependencies of the dependency

Is it even possible? I once checked perhaps at the depth 5-6 and it reached maybe thousands of items. At some point though there were many repeated dependencies, sometimes on different versions of the same module.

Funny, I've worked with multiple companies and their lawyers who were very serious about license compliance and what not. It took all of fifteen minutes to prepare a spreadsheet of our licenses (planned, anyway). Not a complaint from any of them, other than an "oh, that's more than I'm used to seeing."

The one sticking point was webpack 1; they had some dependencies with unlicensed dependencies. Fortunately, we were already leaning towards browserify anyway at the time. Webpack 2+ resolved those issues.

Fair enough. Now imagine that your product or service is gaining popularity on the market where Google or Facebook consider you a competition.

The idea that you should consider "what to do if your company grows to be a competitor to Google" in your technology decisions is quite frankly some of the worst bikeshedding I've ever seen. That question shouldn't even enter in to the process at the start.

If that happens, and it probably won't, but if it does you will have a team capable of dealing with the issue by then.

Considering that both Google and Facebook are heavily invested in this scene with Angular and React, there's not much to imagine. They're both fine with lots of licenses.

They will buy you first.

Acquisition by Big4 is not everyone's dream, imagine.