A cooldown is a coarse way to deal with “supply chain security” — and that’s mostly a question of how much you trust your dependencies.

You may well (and probably should) trust the maintainers and release process of Brotli, Node.js, PHP, etc. security releases more than you trust some-random-JS package deep in your front end dependency graph.

You want to reduce the risk of introducing a compromised dependency into your product, and that’s largely a question of how much you trust upstream.