It’s about the relative chance that someone’s CI infrastructure somewhere in the dependency change gets pwned in a way that allows malware to get into our dev environments or production servers. If we roll our own library for some functionality we need, that risk is 0. My point is the cost of doing so is much lower than it used to be, both in terms of implementation time and maintenance effort.