Yes but then you're no longer grappling with the limitations of the ecosystem. Introducing a rogue developer who updates dependencies irresponsibly is a danger in any language.
Who really audits every single dependency in their dependency tree? not so much a rogue developer, but most.
If you are hobby programming, then not really, but in most workplaces, dependencies are usually pinned and not updated until necessary(bug fixes mostly).
From what I've seen as a contractor usually there is no package-lock at all.