That drama could happen in any ecosystem where developers shoot from the hip adding dependencies without second thought, the same that thought curl | sudo sh is a good idea to start with.
Ryan actually had the foresight to add permission sandboxing to deno from the start though
Sandboxing doesn't help against malicious code that changes expected behaviours or corrupt data.