I had a client complain that some software we recommended installed a database. How fucking dare we install this giant blob of software without his consent! It was MySQL, and integral to the application.

So what's your solution? A click-through acceptance of every single library, component, dependency, etc. every app uses?

P.S. - out here in the real world of the people who just use software, they don't want this. Which is its own problem, because they should care more than they do, but we play the hand we're delt.