An idea about how to secure unserialize() calls in PHP dependencies that aren't using allowed_classes.

secure_vendor_unserialize.php

<?php

namespace Some\Namespace\I\Dont\Trust;

function unserialize($data, array $options = []) {
  if (empty($options)) {
    $options = [
      'allowed_classes' => [
        \DateTime::class, // Set to classes used in namespace.
      ],
    ];
  }
  return \unserialize($data, $options);
}