So this is a risk assessment problem. If you simple command line app depends on more than a hundred different packages then you have to balance the risk of a l

So this is a risk assessment problem. If you simple command line app depends on more than a hundred different packages then you have to balance the risk of a larger more fragmented "attack" surface in your dependencies against the cost of maintaining more of your own code. No one is going to draw their line in the sand in the same place. It's affected by the languages culture, the programmers experiences, the business needs for speed of development. It will change over time as the developer has good or bad experiences and it will change as the business needs change. I don't disagree or agree with the statement because I don't live in an ideal world where I get infinite time for dev and qa.