The fact that including a package in your webpage/app, which includes a tree of hundreds of others, one of which can 'dynamically' overwrite/redefine other pieces of the namespace with impunity, is why it's broken in the first place.

ergo it is insecure by design for all uses, and unsuitable for anything important relying on code you wrote doing what you expect.

It's fair to say it's broken in a world where what we do in webpages MATTERS. It was fine in the past where nothing truly important happened in web pages, but that ship has sailed.

agree, assuming you're talking about language version ES1 circa 1995.