It is though ( and this is something that Brave’s founder has acknowledged).
Chromium is a massive project that is led and controlled by Google and Google does the vast majority of the development worw, Without Google Chromium could not exist as it does, and no Chromium derivative browser contributes even 1% of what Google contributes to Chromium. Every Chromium derivative is building on top of the 40 million lines of code we call Chromium, sure they can modify many surface level things, and some not so surface level things, but because no Chromium derivative browser (apart from Maybe Microsoft Edge) would be anywhere close to capable of maintaining/developing Chromium independently, it is an inherently dependent relationship. (to put things in perspective, in the past year ~2500 developers have contributed to Chromium, 14 have contributed to Brave)
The deeper or larger the changes Google introduces are, the harder (and often more financially costly) it becomes for downstream dependent browsers to undue those changes. This is why so often, when you read statements from Brave’s CEO about things like MV2/3 for example, you’ll notice he often adds qualifiers to guarantees like (“if it is finanicallly feasible”, “if possible”, “until it becomes impractical”, and the like and why he has said on multiple occasions it isn’t an ideal situation for Brave to be based on Chromium (in the early days Brave actually explored using a few different browser engines).
I think you are thinking of dependence in terms of Google being able to force their will on Brave. I don’t think that’s the correct way to think about it. The vulnerability is that Google can (and has incentive to)–either intentionally or incidentally–make decisions upstream which could make it prohibitively costly or too complex for downstream derivatives to undo or neuter the changes.
To see a real world example of this, look at Android. Custom ROMs compete on a playing field that is extremely biased against them, despite android being open source on paper. Because Google has designed it in such a way that Android without Google’s proprietary layer of apps and services (especially Google Play Services) Android is very handicapped. A similar strategy could be applied to Chromium.