And a bug in a dependency you can fix easily. One in the runtime is much harder to fix and you then must compile new versions.

And a supply chain attack is much easier with too many dependencies as well.