Even when you have reproducible builds and local copies of all recursive dependencies, you have to be able to react when e.g. a security vulnerability is found

Even when you have reproducible builds and local copies of all recursive dependencies, you have to be able to react when e.g. a security vulnerability is found in one of them. If you have 1600 of them, you probably don't know them all very well, so you might already be in trouble in the assessment stage. If there's a fix upstream, you might need to update to the newest version, and that in turn might force you to upgrade more dependencies, or introduce new ones etc. Reproducible builds are great, but they aren't a panacea for dependency hell.