> And more of that. But just saying "a lot of dependencies bad" is not useful.

I disagree. The primary problem is that proper dependency auditing is incredibly time-consuming, especially if you want to stay up-to-date. The reality is that most people simply don't do it all.