One bad npm package can really ruin your day. These things for me only run in their own VM with it's own GitHub account and basically nothing else
This is only going to become more of a problem in the future and people need to educate themselves on the technical barriers to use because guardrails only sometimes work.