[christophilus]

If a dependency gets compromised, that’s a problem. If you have thousands, you increase the odds vs if you have one.

[panick21_]

You can also depend on a lot of libraries that have potentially high quality rather then writing a lot yourself. The defense against compromised dependency can't be 'Ill write everything myself and do it with the same quality as the ecosystem'.