Comment by visch

No, and this isn't about a supply chain attack on Python libs. This is about running your service(s) on a service that runs in front of a cloud provider. My argument is simply that it's needless extra risk

You do have an argument to be made about vendoring our dependencies, or removing them in general. Not a bad idea