Yea, definitely agree about automatically. For me the biggest problem with automatic is, exactly as you said, the worth of varying projects.

I think automatic inclusion would also run the risk of OSS becoming less integrated. Ie, if I include another dependency I risk losing money, incentivizing me to reinvent wheels so long as I have the ability.