But here's the catch. If you do that in a lot of places, you'll have a lot of extra code to manage.

So your suggested approach does not seem to scale well.

There's obviously a tradeoff there.

At some level of complexity it probably makes sense to import (and pin to a specific version by hash) a dependency, but at least in the JavaScript ecosystem, that level seems to be "one expression of three tokens" (https://www.npmjs.com/package/is-even).