Many of these libraries cannot have meaningful vulnerabilities. What‘s a possible vulnerability in lodash that can be exploited without already being able to in

Many of these libraries cannot have meaningful vulnerabilities. What‘s a possible vulnerability in lodash that can be exploited without already being able to inject code? Furthermore, any vulnerability in a dependency could also exist in code written by myself or a team member. And then never get fixed or even found.