The problem can be when something untoward happens with a dependency, or a buried dependency, like a security breach, or a licensing issue.

Lawyers will generally chew up the food chain, and applications that use dependencies can get caught in the blast radius.

That can happen with big shops, or small shops.