Yes, package.lock is used by default now. But when you do want to update the dependencies. It will update thousands of libraries at the same time.

However it is a problem of the eco system, not package manager.

Even better, specify by hash - Poetry for Python does this by default. This will prevent cases where malicious actors replace existing versions that you might have pinned to.