So? What's wrong with this? Why would someone check-in all the 3rd party code, when same can be described in package.json & downloaded again.
You get everything you depend on, stuff it into a folder named third-party, and check it in forever (or until security bugs, features you need, etc). Include all and any licences, this is important.
When dealing with any software that's supposed to be our there for decades, the last thing you want it to have unplanned work because of missing libraries.
See anything with a "cute" license, such as WTFPL? Don't use it for work.
I needed some wtfpl code for something, and asked a team of corporate lawyers to evaluate it.
They deemed acceptable, and whitelisted it at one of the biggest software companies around.
But you can always use shrink-wrap or other package managers that guarantee immutability.
Oh, I guess I should say I love npm/yarn and use it as a core of all my projects. ️