Why wouldn't you naively assume sudo npm was safe if you wanted a global package (I know the behavior of npm...)

This is blaming the victims. If the user can blow their foot off, its not the users fault.