Your dependency list does not contain the code most likely to be attacked
Package manifests describe what you chose. Native decoders, fonts and archive readers arrive underneath that, selected by file content rather than by you.
Analysis
Software news, read and annotated by a working engineer
Every system has failures it cannot page you about
Alerting is built on operations that fail. The expensive ones succeed — slowly, twice, or with the wrong answer — and no threshold will ever fire.
Allowlists enforce the day they were written
The list does not get wrong loudly. It gets wrong quietly, and keeps returning the same answer with the same confidence.
A vendor patch is an unreviewed change
Every release process guards the code it writes. Almost none guard the code that arrives on somebody else's schedule.