It's just like saying every dependency is a ticking bomb. In a very strict sense, it's true. But it really doesn't matter for most businesses (and absolutely doesn't matter for early stage startups.)

Depends on the domain really, along with you and your user's aversion to risk. On average I'd agree your take holds true though.