Comment by horsawlarway

Two things.

1. Deps are an organizational hassle. They need review, get flagged as security and legal risks, and (mostly incorrectly imo) have been somewhat tarnished by the idea that deps are all just "leftpad" - simple things that are over abstracted. This is the "incorrect" argument that I don't really think should carry much weight, but often does win the discussion internally in organizations.

2. Deps can be misaligned with your precise needs, and you often end up "owning" them anyways the second you patch/fork/modify it in any way. This one is legit. It's a real thing that happens and is painful. Sometimes being honest that you should just be responsible for the thing in the first place is the right call. This one I buy as an argument, but it just doesn't apply to that many deps.

But the combination of the two makes larger organizations somewhat adverse to dependencies on average.