If your dependencys are out of your control then you are incompetent at security, full stop. Wrangling your dependencys and inputs is security and engineering 1

If your dependencys are out of your control then you are incompetent at security, full stop. Wrangling your dependencys and inputs is security and engineering 101. You will not get meaningful security without doing so. Being unable to do a critical part of the job because it is hard is textbook incompetence. Everybody everywhere in software being totally slipshod on these elementary practices is a big part of why there is no meaningful security anywhere.