I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.
The dependencies weren't vendored, meaning their behavior can change at any time if a malicious actor gains control of that third-party repo. This is bad for security.
Yes, I agree. And it's sadly, as we can see, still fairly standard practice to ignore it.