Yeah, the problem is the balance. In-house code sucks. Nobody outside the team tests your code. Self-developed code is not battle hardened. You can only use the skills available in your team and especially for specialist topics like databases, security or cryptography having in-house expertise is rare and expensive.

Using external dependencies sucks. You are dependant on externally developed code and on someone elses skills, quality controls and trustworthyness, and you usually don't have time or ability to really verify any of that. Even a good dependency can get stuck in some kind of development hell (like e.g. OkHTTPClient) and not deliver updates for years, and supply-chain attacks are constant threat.

In the end both options suck for different reasons and it really depends on the scenario where one or the other is useful. Leftpad is an extreme example, but most options are less obvious.