It's an order of magnitude difference. Code running at install time is almost 100% guaranteed to run. So a transitive dependency 10 layers down is just as dangerous as any other.

Runtime, however, you need some code path to actually hit some part of that library/import it to be affected.