In this case, a one-time review might have sufficed; this bugfix was the first release in five years. But generally speaking, you're 100% right — and obviously,

In this case, a one-time review might have sufficed; this bugfix was the first release in five years. But generally speaking, you're 100% right — and obviously, this little package is orders of magnitude less complex than e.g. React or Express.