A dependency tree shows the package you asked for and the transitive deps it brings. pip freeze is flat and hides who pulled what in. For an installed venv use pipdeptree or uv pip tree. To see a package before you install it, open it on PyDeps. The tree, OSV findings, and licenses sit on the same page.
Installing requests also installs urllib3, certifi, and more. Security and license risk often live in that nested set.
pipdeptree, uv pip tree, pipgrip, and johnnydep cover the terminal. Open PyDeps when you want the tree in a browser without making a throwaway venv.