Something that frustrates me about that discourse is that people argue about the mere existence of dependencies but all 'supply chain' (1) attacks are issues over when dependencies change. Dynamic systems are harder to reason about than static ones.

(1) scare quotes because I think it's dumb for us software people to call code we picked up on the side of the road part of a 'supply chain' like that means anything.