Do they? They didn't used to. In 2015 we were routinely dead in the water, unable to test and deploy
anything from our google3 projects because some random submitted a CL for a project we didn't even care about. Teams would appoint "build cops" whose job is to
complain as quickly as possible because that's all we could do about it.
Every problem you could have with bad dependencies is entirely self-inflicted. The Right Thing™ is to choose a known-good version, and update when you have the bandwidth to pay down the tech debt.