This whole comment is spot on. To take the lodash example, you can easily hand-roll a bunch of methods to do things like group-by, index-by, etc. If you're not

This whole comment is spot on. To take the lodash example, you can easily hand-roll a bunch of methods to do things like group-by, index-by, etc. If you're not careful though, it's very easy to introduce a prototype pollution vulnerability in this, as lodash the themselves have done. The difference between your code and lodash is that this vulnerability is much more likely to be caught in lodash. And when lodash fixes the vulnerability, all you have to do is update the package, rather than writing a bunch of code (hopefully correctly this time). One of the real issues with the JS ecosystem is that we don't have a way of capturing that information about degree of trust. People tend to use number of downloads as a metric, which is better than nothing I guess. But what if there a way to capture whether the library has a bug bounty, or information about governance practices?