AI auditing of dependency updates will mostly likely come soon (if it's not already there), and should mitigate the most obvious cases at least.

(By this I mean integrated in something like dependabot, not just some security companies doing it and publishing reports.)