Here's what I see as one of the problems with modern web development.
Pictured above are automated pull requests for security vulnerabilities in core npm packages. The problem is, for some of these libraries, I couldn't tell you what they do, why they do it, or why my React application needs them. You know what won't contain security vulnerabilities years down the road? plain HTML, CSS and if you're feeling naughty a bit of vanilla Javascript.
Some might say:

Surely it's not difficult to keep up to date?

In response, I Say that I have better things to do than keep up to date with advancements in an ecosystem, that in many use-cases aren't even needed. TLDR; don't make things more complicated than they need to be.