It also creates downstream impacts. Reddit famously had a major outage caused by this; my team had all of our builds break because a transitive dependency changed methods from "blacklist" to "allowlist".