Modern software has massive numbers of dependencies.

Javascript / Typescript has the most, but every language has way more in the average bit of software than a decade ago.

Once dependencies were solved structurally, they exploded.

At decision time, the concrete benefit of using a known-to-work dependency wins out vs the theoretical, diffuse risk of supply chain risk.