I don't feel like that's a good faith reply. I'm making the claim that react's production build core is surprisingly small and shouldn't be considered a security risk (or attack surface as someone above phrased it).

Do you dispute that? If so, why?