Many of these libraries cannot have meaningful vulnerabilities. What‘s a possible vulnerability in lodash that can be exploited without already being able to inject code?

Furthermore, any vulnerability in a dependency could also exist in code written by myself or a team member. And then never get fixed or even found.