This only "kind of" works for dependencies which you explicitly include in your project. My understanding of the left-pad issue was that it was frequently down

This only "kind of" works for dependencies which you explicitly include in your project. My understanding of the left-pad issue was that it was frequently down the dependency tree where dev's themselves could not remove the dependency on left-pad without modifying or branching a dependency (or perhaps multiple).