The point that the parent commenter is highlighting is that if somehow a malicious package version is introduced, since nobody actually is auditing the changes

The point that the parent commenter is highlighting is that if somehow a malicious package version is introduced, since nobody actually is auditing the changes that are being pulled in, it is possible for the tests to pass and introduce a security vulnerability. They're suggesting that the contents of the actual diff in the packages should be reviewed.