It's an issue, but not a new issue and not an issue introduced by NPM or introduced by package managers.

People were cuddling and pasting code from random people on the Internet they didn't understand for many years before package managers where there were zero maintainers. Many people that don't properly understand supply chain issues still are.