If you could understand the quality of updates you're pulling in, that solves the issue entirely. The point is that you can't.

There's no reason to pretend we live in a world where everyone is manually combing through the source of every dependency update.