Comment by RhodesianHunter

That's only true for libraries with zero transitive dependencies.

Otherwise you're almost guaranteed to be pulling in un-patched vulnerabilities.