The more I've thought about this the more I think the first point is the best decision for every long-lived application.
Wrap _all_ third party library calls. This lets you reduce the scope of these calls to "approved" ways and make much stronger assertions about who's doing what in your code.
This gets super useful the further down the line you get to adding really complex features. Being able to isolate all the places where certain objects get created to add a permission check is nice.
It also makes testing easier because you have some nice entry points to mock.
Raw usage of things like an ORM can let you get through a prototype super quickly, but makes editing the application later on quite hard.
Wrap _all_ third party library calls. This lets you reduce the scope of these calls to "approved" ways and make much stronger assertions about who's doing what in your code.
This gets super useful the further down the line you get to adding really complex features. Being able to isolate all the places where certain objects get created to add a permission check is nice.
It also makes testing easier because you have some nice entry points to mock.
Raw usage of things like an ORM can let you get through a prototype super quickly, but makes editing the application later on quite hard.