scoop is fine since it keeps itself confined to user profile, unlike some other package managers.
Doesn't winget prefer to respect the package source's intention?