Not a lawyer, but I can imagine it can be expected that you do some due diligence before installing it through npm - like checking the website whether their license allows you to use it, and on what terms.
In the Netherlands, somebody was recently fined for using an image she got from a "free photo's" website. It was a picture that was illegally published on that website, and the judge said she should've checked whether it was actually royalty free. The fine was even higher than expected because she also cropped the picture, which was another breach of copyright, apparently.
I personally find it unhelpful that the program never clarifies that it is a display of binding arbitration instead of a decision by a judge. I've seen the layman confuse the two quite a few times.
Also, while I agree that they don't have to follow the law, they usually do. In the end, the 'judgement' is still based on the law and legal precedent, like in an actual court case.
My React project has 1,015 dependencies (directories in node_modules). If I didn't have locked versions then every minor automatic update could bring in more dependencies without me knowing.
Can anyone honestly say they've done such due diligence?
That seems doubtful.
And that's a real and potentially serious problem, because IP laws typically don't contain any exemptions for code you're using that infringes someone's IP rights just because it was contributed by a third party.
That said, the amount of dependencies you have locally installed is likely to be a multitude of the number you'd get if you'd exclude devDependencies, which I'm guessing don't count.