Security teams generally have policies that require dependencies be up-to-date within a certain time frame. This is especially true if the dependency has a CVE

Security teams generally have policies that require dependencies be up-to-date within a certain time frame. This is especially true if the dependency has a CVE somewhere within it - even if that CVE affects functionality that isn't utilised by the project.