So why does this not apply to everything? If "this could go way deeper" is your answer to a super unpopular rubygem getting hijacked, why isn't that just the d

So why does this not apply to everything? If "this could go way deeper" is your answer to a super unpopular rubygem getting hijacked, why isn't that just the default assumption then? Do you only use thoroughly audited software projects? How do you manage that?