IMO, that's more of a sad story about the state of respect for supply chain risk management in the software engineering discipline. It may be convenient at fir

IMO, that's more of a sad story about the state of respect for supply chain risk management in the software engineering discipline. It may be convenient at first to add a bunch of dependencies for free that solve a particular task, and ignore the part that says "AS IS WITHOUT WARRANTY OF ANY KIND". The only thing a FOSS license gives anyone is code. It never gave anyone maintenance or support. Any organization that uses software that is "as is" should have a plan to maintain that software themselves, or mitigate the risk in other ways. And many of the large players in this industry do exactly that, and their full-time employees are top contributors to many large FOSS projects.