You can compromise and give the developers the ability to add dependencies as well. In a separate “dependency mirror” package. But those have to be code revie

You can compromise and give the developers the ability to add dependencies as well. In a separate “dependency mirror” package. But those have to be code reviewed like anything else. So you have a paper trail but adding a dependency is lower friction. And you still can’t accidentally (or maliciously!) pull in an evil dependency without at least two people involved.