There's another, deeper issue though: devs have been losing control over their code.

I do the dependency hygiene for SN a couple of times per month and twice in a row have I found verified regressions in upstream packages coming from bugfixes, that according to their authors are written by bots. High-end, state of the art, bots.

This is bad, because it is debt. Plus I have to spend shittons of time to check if such a regression has impact, so it is super costly on the consumer side. Note that these are packages with 100s of 1000s of deployments, and for sure, "automated security" like socket.dev didn't see it - thus far it has called me out with false positive findings every single time, but not once has it alerted on a regression that I spotted.

So, I think that if you are a serious project then your security budget, even if it is just measured in the time you spend plus maybe some tokens, must go up. Preferably yesterday.