It's not invulnerable, I think gp just means that reducing your amount of dependencies reduces the attack surface.