when those packages are not under your control, it has everything to do with how granular they are and by extension how many you depend on and thus have to trus

when those packages are not under your control, it has everything to do with how granular they are and by extension how many you depend on and thus have to trust/verify. when was the last time you rechecked the entire source of a package you depend on after updating it?