Now I think about whether the downsides of relying on third party dependencies are outweighed by the upsides.

Supply chain attacks are real. Project maintenance suffers for many projects in the long term.

If you can write a left-pad function, just write left-pad.

If you are implementing a 200 page open spec for a system that needs to interoperate with 100s of other systems, consider looking for a community effort to rely on and contribute to.