I would say "might," as opposed to "would." Big systems have big surfaces, no matter what quality they are. Dependency chains may be more of an issue. I think

I would say "might," as opposed to "would." Big systems have big surfaces, no matter what quality they are. Dependency chains may be more of an issue. I think several of the last few big exploits have been compromises in fairly small packages, that were incorporated into larger ones. Then, there's the "Bro Coefficient." Who wrote the package should count for a lot. I'd trust a package written by "linus.torvalds," a lot more than one written by "L33tCoder420LOL," even if the Web site is super-sexy, and it has a gazillion GH stars.