It's already happening but slowly. Mainly because of some high profile incidents regarding huge dep trees and dropping support of old browsers and runtimes which means usage of native APIs. Webpack 5 has half of webpack4 deps for example.
Really? I hadn't looked at Webpack 5 yet. If that's the case, that's great!
When I ran create-react-app npm said it audited 960000 packages. I wonder where it got that number from then?
I honestly have no idea where NPM pulls its audit numbers from. If I open up npmjs.com right now, it says there's 1,153,926 packages in total on NPM. While CRA does have a bunch of transitive dependencies, I can guarantee that CRA does _not_ depend on 83% of the entire NPM registry :)
Which is still way too many, and I'd love it if the JS community would spend some time working on collapsing the dependency trees for widely used tools like Webpack.