I don't feel like that's a good faith reply. I'm making the claim that react's production build core is surprisingly small and shouldn't be considered a security risk (or attack surface as someone above phrased it).
Do you dispute that? If so, why?
Your claim that the "react core" is small isn't correct. React+ReactDOM is >130kb, the minimum needed to run a react component. To create TUIs, Ink ships even more.