“Once you build on top of existing components, those vulnerabilities, those properties of those components become an inherent property of the overall application.”

Transcript evidence from Steve Springett -- Dependency Check and Dependency Track.