I hate to even ask, but for a security-focused product, is that a good thing?

I think there is a valid argument “there is no good video experience on web otherwise” but that’s still a long list of less-than-fully-mature dependencies.