but... why not just use pnpm? It's generally a straightforward migration.

It has dependency cooldowns, build scripts disabled by default, and the setting you mentioned.

The simplest reason might be that it's not the default so people use npm out of habit.

Personally, I use volta and switch between node versions in different projects, so I prefer to just use npm.