Now instead of npm packages abusing SemVer unless you use non-default --save-exact behavior as an attack vector, we can import modules from URLs without subresource integrity unless you use non-default lock file behavior! Great! We learned nothing!
If you wanna take it a step further, you can always opt in to that lock file with various degrees of strictness as you yourself mentioned