Wait, what? I'm so confused. How is this security theatre and how is it better to have curated packages than an open ecosystem when it comes to "hostility"?