Yeah we forgot it years ago because it was only an issue for a few hours and then lock files were introduced into NPM along with a CLI warning system for vulnerabilities.
Amateurishness is normal to some extent, but JS has the ecosystem where beginner mistakes are often seen as the right way to do things.