Staggering to imagine a developer using emacs would use some random community package corner-case function to install and keep updated an important package written in the same language he programs with.
I'd prefer to install pyright myself in my own node virtualenv rather than having it dropped into ~/.config/emacs/.cache/lsp/npm/pyright, but I understand why autoinstall is an attractive option.
Feature regressions and security holes from those sources will effect everyone, even those installing manually.
It's not that it's hard, but it's Yet Another Thing That Can Go Wrong.