1. Both tools will not catch it, you need something like https://github.com/maglnet/ComposerRequireChecker

2. That doesn’t apply to PHPUnit specifically, but if you, for example, import PHP-cs-fixer as dev dependency, it will bring symfony/console, and if you rely on that on your own code without importing it on composer.json as a regular dependency, the class will be missing when you composer install for production.

Ok I get what you're saying now, that's fair. Tbh I mainly do Symfony so most of what dev-dependencies use are already in the dependencies for me so it never happened