Yeah, but a dependency attack is a rarer issue than out-of-date dependencies that contain known security vulnerabilities.