[dspillett]

> What can I do as a developer to offer that choice to the user, before it loads?

Don't load it until you have given the choice to the user. Dynamically load after that, or wait for the next server round-trip.

> What can I do about the transitive dependencies that my dependencies load?

This is a significant problem for which I don't have an easier solution than making a lot of effort to properly audit and monitor your supply chain.

If you aren't sure that nothing in your supply chain is doing something dodgy, how do you justify pushing it to your users (or, at least, doing so without appropriate warning)?