Agreed. It's a problem, but VC just isn't built for dependency management.

Since the histories of the dependencies don't get tracked, merging them can be tricky. Especially when dependencies get upgraded separately by multiple people.