I don't think the issue is "too easy" here, but the lack of downstream verification tools. If you had a clear metric for all the parts that go into a library y

I don't think the issue is "too easy" here, but the lack of downstream verification tools. If you had a clear metric for all the parts that go into a library you wouldn't worry about how many there were. And if the library author likewise cared about their libraries metric, they wouldn't arbitrarily choose low-quality libraries. Friction isn't useful here imo. Trust is just as bad with high friction, just maybe less moving pieces. Not having verified metrics seem to me the real problem. Some sort of safety rating that bubbles up from all the dependencies. Changes to software owners would also have to cause issues in this system too.