How does one actually avoid this? e.g. Say your boss needs you to make a react native app - you start their default project, pull in a few Expo libraries for core functionality. At that point there are hundreds of third party libraries that are being pulled in that you can't realistically vet.