Could be. But a) I don’t know why I’d trust them to do that when existing tooling means I don’t have to and b) this is not a new paradigm for me. I’ve been running most of my dev environments in sandboxed mode for a long time. I don’t trust npm either.