What about the vulnerabilities you yourself introduce when using AI? or is the assumption that (1) there will be zero or (2) you won't ever open source so no one will know about them?
It’s about the relative chance that someone’s CI infrastructure somewhere in the dependency change gets pwned in a way that allows malware to get into our dev environments or production servers. If we roll our own library for some functionality we need, that risk is 0. My point is the cost of doing so is much lower than it used to be, both in terms of implementation time and maintenance effort.