@mousebot I don't vet all the software I use because 99% of it comes from apt, but of the 11 elisp packages I use that I didn't write, I've read thru at least most of the source of all of them except exwm (because that's deep magic I have no hope of understanding)
maybe a compromise would be to write the code so that it fails gracefully when the dependency isn't found where possible, but declare a dependency in the comment headers anyway? that way package.el users (who are less likely to care about vetting) will get the feature, but people who install manually will benefit from less dependency creep