Lol yeah working in enterprise software for a long time, it’s more like:

1. Import what you think you need, let the CI do a security audit, and your senior engineers to berate you if you import a huge unnecessary library where you only need one thing
2. Tree shake everything during the CI build so really the only code that gets built for production is what is being used
3. Consistently audit imports for security flaws and address them immediately (again, a CI tool)
4. CI

Basically just have a really good set of teams working on CI in addition to the backend/frontend/ux/security/infrastructure/ whatever else teams you have