An interesting facet of this is the implicit trust by the author towards the downstream tooling and libraries. He is not alone.

We talk about how we need to make sure dependencies are secure, but I venture to state, it is often just brushed over. Yes, supply chain security (now to rinse my mouth out).