There is also a risk that the person may be malicious from the start, sell out, or simply get malware. Given the nature of the ecosystem a malicious release to a previously safe package could propagate incredibly quickly.
Where there are multiple steps for a package to get from developers machine to yours and each is slow enough for malicious behavior to be noticed each step adds friction and decreases the chance of ultimate success. Where all steps are nearly simultaneous your risk multiplies with each step in which a different person has their hands in it and if any of them are malicious or compromised you are screwed.
Requires a different way of working with projects though, so understandable if that's not your thing.
Sometimes it feels like I'm just being asked to install a real linux distro inside my linux distro so I can actually do things. Here's you nice shiny desktop and app store! Oh you want to do more than browse the web? Better install linux again in a VM.
Maybe i'm just stuck in legacy paradigms, but I kind of like just booting IntelliJ and picking the project i'm on today.
Or sometimes I want to move stuff between projects i'm working on, that's a lot easier if my one IDE instance can hit them all at the same time.