You install a package. It solves a problem. You move on. You do not think about it again. But that package is now part of your application. It has access to your data. It runs in your environment.
If that package has a vulnerability, so do you.
The Numbers
A typical Node.js project has over 500 dependencies. A Python project has over 100. A Rust project has over 50. Most developers do not know what is in their dependencies. They know the top-level packages. They do not know the transitive ones. The packages that are three levels deep. The ones that were installed by a package that was installed by a package.
Those are the dangerous ones.
