As opposed to blindly trusting and adding a dependency for a random library with a one liner?

I don't think the "don't roll your own crypto" argument really applies here. Of course we can come up with hypothetical situations where developers are incompetent or don't test their code at all. This includes armchair analysis for a post on HN, by non-javascript developers.

I would argue that it's still better than adding a dependency. Heck, you could even copy/paste the correct code.

I know I'm not a perfect programmer, so important functionality like this gets unit tested as necessary. :-)