I also don’t understand how everybody is installing these packages with npm -g and not worrying about anything
No because _you_ are in control. Not the AI.
Maybe you do today. Will that always be the case? People running Windows do not have as much control over their systems as they should. What does enshittification look like for AI?