Sort of a cake and eat it too mentality if you ask me. If you're not willing to build your own JS glue then you should at least take time to audit the glue you are pulling in from some thankless developer who probably started this as a hobby project in college and now it is the backbone of 10 fortune 500 frontends.

I'm sorry that they can then do whatever the hell they want with that package but this ecosystem exists because companies want free stuff but don't want to provide back into it.