The standard stack is unnecessarily complex and very difficult to security-audit. By not having any third-party dependencies, you don't need to trust thousands of individual developers to not have their NPM accounts compromised or to push something with a subtle security bug.