According to HTTP Archive 62% out of top 1m websites load vulnerable JavaScript libraries. There's a significant drop from 2020 where the average was ~80% (!), apparently mass-scale web attacks taught some lessons https://httparchive.org/reports/state-of-the-web