Working with NPM every day, that’s kind of how I look at it. Maybe my computer will be randomly wiped one day, but it’s not something you can worry about if you want to retain your sanity.
I build my nodejs/npm stuff in containers. Actually I build almost everything that way.
There are a lot of advantages in addition to the security gains, such as that I don't need to rely on every javascript programmer in the world understanding semver (they don't, and I have wasted more of my "sanity" on tracking down API changes and sloppy type contracts than I ever have spent cleaning up after malice.