Nested dependencies are an important factor as well. The majority of security issues (and hacks), as well as a large number of issues, originate not in the library you chose to consume — but in libraries they chose to.