Well before anything I need to point out that the recommendation is usually to exclude such libraries from the analysis, as those are dependencies which are not maintained by the dev team from the main project.
As for the figure of 10 as a threshold, if it’s about Cyclomatic Complexity then it’s worth reminding that this is a concept that pre-dates SonarQube. See here:
At SonarSource we’re also offering a new approach to this: Cognitive Complexity ! See this blog post, and also below discussion: