A recent article argues against using dependency cooldowns to mitigate software supply chain attacks, noting they disproportionately burden active maintainers. The author contends that relying on mandatory waiting periods turns developers into free-riders who falsely assume their packages are secure without properly verifying their dependencies. Ultimately, these blunt mechanisms fail to address root vulnerabilities while stifling legitimate open-source collaboration.