Comment by francescovv

> 100s of dependencies. If there is a 1% chance of a random repo having a backdoor, the project will be compromised

Apologies for nit-picking, but that's not quite how sum-of-probabilities work. Total probability across 200 tries of 1% chance each, is ~87%:

  p=0
  for _ in range(200):
    p=p+(1-p)*.01
  print(p)

  0.8660203251420382

Your "sooner or later, to the point where we can assume" conclusion, still stands, of course.