Your comment made me think that people have been happily importing hundreds to thousands of dependencies into their projects that were written by some random guys on the internet, but they've just now started to become concerned they don't understand the code they're shipping.

Exactly right. Many never check the release notes of those libs on bump either. To this add copy & paste from Stack Overflow we used to do. People are just afraid of losing their jobs now, so naturally we all got defensive.