I cannot think of a reasonable argument against this if security is any priority at all at NPM.