That’s not quite what I meant. The concern isn’t that dependency code will contain bugs or vulnerabilities directly. The concern is that introducing a dependency introduces a whole new supply chain, of which any link could become compromised. No new dependency, no new supply chain.