Not saying this is automatically a problem, but you will lose money over this. When a build dependency is unavailable or broken, you cannot create production artifacts. You'll lose money over this because broken builds lead to incidents, longer time-to-recovery during incidents, and slower development. All of these cost money.
Your exposure to defects in your build dependencies will depend on a lot of factors, but the exposure will always be there.
Deps aren't unavailable or broken if I cache and pin them, and I do, because not having done so would have cost me a lot of time and money a long time ago.
Your exposure to defects in your build dependencies will depend on a lot of factors, but the exposure will always be there.