Your comment assumes that security issues are only discovered because someone downloads the package. This premise is incorrect.