Agreed. Next step, it'd be just great if most open source software (and presumably most non-OSS code, although that's harder to determine) didn't pull in half the internet as mostly pointless dependencies. While we're at it, it'd be sweet if major OSes like Windows and most Linux distros would move to a threat model of "machine is used by one or more users who each want to safely run untrusted code without risking their own files, safety or privacy" instead of the old "machine is shared by many users and our main concern is guarding them against each other" model.

How does one actually avoid this? e.g. Say your boss needs you to make a react native app - you start their default project, pull in a few Expo libraries for core functionality. At that point there are hundreds of third party libraries that are being pulled in that you can't realistically vet.

The open question being: who can you trust. (And the XY backdoor shows that the answer is not trivial at all).

But how can we be productive as programmers without blindly copypasting random stuff from the Internet?

...well, I guess if your project is mostly about its internal business logic, not interacting/integrating with the wide world via the loads of weird and poorly implemented protocols and points, then you could be. But is this where the money are?