You're right - that's why macos definitely hasn't spawned suspiciously debian-like package managers in an attempt to handle all these problems.
And if we're talking about "app bundles", if you dig a bit deeper you'll find most of these applications which "just work" just bundle all of their dependency libs. God knows if they bother to update them or do a security release if vulnerabilities are found in their bundled libs!