> So you're expecting to see every product affected by this to go and do a big mea culpa because one of their dependencies broke?

Yes, absolutely. It's the bare minimum for people offering commercial products.