They just use npm as a binary delivery mechanism, for whatever reason (I guess they expect all their users to have npm?)

It's pretty darn ubiquitous, yeah. Plus enterprises tend to run npm mirrors, so delivery integrates into existing IT compliance frameworks.