Open source can be a double edged sword for that but I dig it.

I think dependencies in Linux packages does cause a lot of issues but that's mostly on air gaped networks, and even still manageable.

Sizing the target depends on what threat actors are involved though so those broad stroke statements don't hold up well in reality, from my Experience.