I'm not saying you need to audit every line of code.

I'm saying it should be trivial to fork any dependency in your tree.

Every project I've ever worked on has met this - but I'm a Nix guy.