Seriously, the worst ones are nodejs and rust: they fundamentally break the nodejs dependency model, flattening everything. They've chosen _controlling_ dependencies instead of _annotating_ them for understanding. Metadata about what's in a package and a package-build-time mechanism for substituting things in lockfiles would be far far simpler for forcing security updates than rewriting everything to use system dependencies, and versions that are not reconcilable.
Heck, both npm and cargo have put a lot of effort into repeatability though not actual hermetic builds, so it's very much Good Enough if you're using lock files. The problems are in updating those, not building packages. Mirror the registries if you need to. That's a much more tractable problem than _rewriting parts of everything you package_ or _eagerly packaging every dependency as a separate [human] task_