It's not that bad.
composer show -it shows a huge tree, but if you leave out the repositories hosted by Magento itself and the PHP extension requirements, the external requirements are:
The big frameworks are not going to go away any time soon and other than in the node.js world, there is no trend to depend on countless micropackages, so that the removal of one unremarkable package breaks many applications and frameworks. The Zend Framework has no external dependencies at all and symfony only a few (listed above).
But the question is still valid:
What if one of those external resources gets removed by the author and in case of possible harm, what can we do to prevent that ?
I don't know if Magento has anything like that in place, but if you want to insure yourself from this situation, you can always use
Toran Proxy Private Packagist to maintain your own mirror of packages from packagist, github etc.