> If they had built their own framework, the team that produced it could just as easily published a security patch that was ignored.

I believe you're just making the inverse assumption from Cox. He seems to assume a monorepo-esque setup where everyone depends on HEAD, and you seem to assume a microrepo-esque setup where everyone declares their own dependency revisions.