> So I really hope you don't pull in packages randomly. That sounds like a security risk.
It absolutely is, but that is besides the point
> Also, good packages tend have a team of people maintaining it. How is that the same exactly?
The famously do not https://xkcd.com/2347/
If you're a developer, you do yourself a disservice by describing it this way.