> Not sure how we could fix it without slowing way down and doing a lot more work.

Can create a market for library audits that the library's team would pay for and provide "vetted" tags for libraries that have audits on minor updates.

Things can continue as they are for smaller libraries, but any library that's used in more critical areas should have no issue finding audit sponsors.

This would also create in incentive for somebody to develop automated auditing tools.