Ok, I concede it is possible. Just like going to the moon is possible. But in practice everything I see that pulls in the node ecosystem even peripherally suffers from this. 100's of dependencies are not rare at all, and some of those on the most obscure packages.
You aren’t wrong. After years of seeing things going that way, I’m hyper critical of any new additions I make to my own software or anything my team is working on.