Minimalism has a cost. http://npm.broofa.com/?q=zero
That said, it looks like the latest (not yet npm-published?) version of zero has moved all the dependencies to `devDependencies`.
You will eventually be adding all those packages when you develop a production-grade React / Node app anyway.
node includes not everything and concentrate on the core. If modules have bugs, not all apps a compromised.
It is a fundamental design decision, if you not like it, don't use node.
You can include all dependencies manually and update them manually, nobody keeps you away. But have fun to update all your deps.
Maybe if you listen too much to twitter "thought leaders" you might get this impression, but we are all aware of the problems with social media platforms...