You’re not wrong, but at some point, the dependency problem will slip onto someone’s desk in then legal department and rules will be pushed back across the hall

You’re not wrong, but at some point, the dependency problem will slip onto someone’s desk in then legal department and rules will be pushed back across the hall into the engineering department. It’s not a bad idea to stake out a product that’s mature and ready to go when that happens. It doesn’t even have to be foolproof. It just needs to be earnest enough to check off some boxes and show that “best practice” effort was made.