This is just optional.

I explained why it's not in the package in https://news.ycombinator.com/item?id=48881722

For all Emacs package updates, it's best of course to check the source what's changed and then you can compile yourself.

PS, I also think Emacs is one of the few ecosystems where people actually check what changed. It's not like npm where you have a million of deps unreviewed pulled in.

Personally I use borg and always at least quick check what changed, and most Emacs package managers have a similar feature.