a distinct lack of sufficient push-back to use established packages and libraries

Yes, but OTOH there is the terrible tendancy of some developers to use every package under the sun, creating integration pain. If the technical solution is well defined or simple enough (eg. add particular http headers, min/max/isEven functions), then let the agent just do it instead of pulling in a potential security risk. If it’s finicky and error prone (eg. JWTs, crypto), then use the established libraries…

That’s a high-quality essay.