What the "security" team doesn't realize is by blocking actions in this way they've opened up a wider hole. If a third party action had a problem it can be blo

What the "security" team doesn't realize is by blocking actions in this way they've opened up a wider hole. If a third party action had a problem it can be blocked centrally, instead these modules now live scattered throughout the code base relying on individual development teams to keep them updated. Those teams will not always be fully funded to keep an eye on every vulnerability in every module and keep everything up to date the same way a centrally managed dependency system can.