You aren't being paranoid IMO, but there are reasons it is done to some level.
Personally, as for depending on 3rd party npm modules that only implement a few lines of Javascript, I generally avoid doing it as it feels wrong. I also wouldn't say Javascript developers favor tiny dependencies, they are just trying to generally avoid rewriting the same line of code across multiple places since that can obviously create a lot of headaches. While there are ways to handle includes, modules etc, across projects it can get messy fast and cause lots of stability issues, but using small versioned packages generally resolves those issues, at least in my personal experience.
My own basic thoughts:
1. if you only need that code in one project, just create a small module and include it, done.
2. if you want to share that code amongst multiple projects utilize npm private packages, or create a local npm repository/cache.
I generally opt to use npm private packages as it allows for easy reuse internally across multiple projects without having to copy or reimplement code. Plus you can take advantage of versioning them which makes life a lot more flexible and robust.
Also, don't forget there are license terms that can affect which packages you use too, so that has to come into play as well when you are selecting them.
