Two bads doesn't give you one good.

No, but when you’re arguing that common practices followed by pretty much everyone is “bad”, it’s hard to muster much urgency.

Yeah, we should do this differently. We should probably also eat healthier and get to the gym more.

no, but it does give one multiple vectors for exfiltration of your data which is a good thing for the scammers of the internet. A bad thing if you naively designed your package management system. Sadly, it's only going to get worse.