"There are a lot of emerging supply-chain attacks, and I simply don't like the idea of installing tens of plugins to Vim/Neovim to make the editor usable." This is exactly what I’m concerned about.
this used to be a valid selling point for helix until neovim added LSP and treesitter support to the editor, which happened years ago. modern neovim is quite capable out of the box.