Django comes with a lot: auth, caching, csrf protection, an orm, the admin, form workflow, templating, migrations, i18n, and yet doesn't come with thousands of deps.
I know of a 15 years django project that runs on 2.7 that is still making money. It got reinstalled this month on brand new Ubuntu servers out of a rubbish requirements.txt, and it worked.
Django can also serve a boatload of concurrent users, way more than one would think. It is a boring, old-fashioned, but stable and very functional framework.
Maybe django is less so a dependency bloat than most other frameworks. Just called out the common consequences of getting more. You get more.
Npm projects are likely the most bloated by far, but also are java based projects, just look at Spring.
Calling out a python framework or some Go lean solution being the exception of the rule is fair enough, my point is developers expect everything and have little to do but rapid painless developement
I would love to hear about those asked to migrate their python 2.7 django ecommerce app to python3 since v2 is totally dead and unmaintained posing serious security risks. But sure if we forgo these things, and don't ever need to touch the code again, some frameworks have no downside. Makes a certain kind of developers finally be right.
