Had they written all the dependencies themselves, would they have been as secure and robust?

The tradeoff isn't simple, and will be different for each company. I think everyone can point at a couple of components that are complex and massively benefit from the work poured into them and the large install base finding all the edge cases. Equally everyone can name a couple of dependencies that anyone could rewrite in a couple hours, and maybe even improve on the way.

Maybe, maybe not, but they certainly wouldn’t have included as many widespread, well known vulnerabilities with exploits already in the wild. And even if the imported code was perfect at the time it was imported, pulling in changes automatically is still an attack vector that you could drive a fleet of buses through.

Note that I’m not saying “never use libraries”, which your points seem mainly aimed at. Code reuse is great! I’m just not sold on automatic, unmonitored updates to libraries.

It’s even scarier when you actually sit down and review some of the code you’ve been importing for years…

It has resulted in a major thinking shift for me. Mostly initiated by a malicious nodejs package being quietly pulled in.

Is there a language ecosystem you prefer now?

I mostly write stuff in Go with no imports at all now. It’s just that and stock vim on macOS is my entire stack.

I am fortunate that my own contributions only require that.