As @ianpurton stated: Defense-in-Depth works.<p>The instructor is teaching a class with some people who may be bad programmers, some that may be good, and some that may be great. The safest general advice is to rely on well audited and community trusted third party libraries.<p>Ofc those libraries were built by someone in the first place, but a lot of them have 50+ contributors and have in-depth controls and standard reviews. A more generalized answer is "it depends".<p>Regarding the point that many libraries have been exploited, that's true, but the counterpoint is if that well audited library with tons of reviews and contributors was exploited, what makes a single individual or small team think their code is completely secure?<p>For the above statements, these are mostly made for questions surrounding security-related libraries; authN, authZ, middleware/routing, etc.
There's always a chance the random JS manipulation library might introduce an XSS vuln or something, but it pays to be safe, especially where it really counts.<p>For in-house vs. pulling a third-party, I'd look at:
- How active contribution is
- How much it's used
- Who is using it
- Does it solve the program's need exactly
- Where it's hosted / If it's had any reviews<p>The last point can help give a little reassurance because if it's a library being tracked by a body/org you'll probably get an update if a CVE is found. Also, if the library is hosted somewhere like GitHub it should have the added benefit of CodeQL access.