These are terrible examples that don't prove a single thing. Babel, Webpack, and React all used leftpad as dependencies. Blaming someone for using an Apache project is absurd.

Here's my pointless randomly made up on the spot anecdote - you're more likely to write a vulnerability in your own logging system than being impactedby using a widely adopted opensource one.