This was my first thought, as well. They never draw any straight, solid line from flat promise chains to security. It's at best a "my preferred style encourage

This was my first thought, as well. They never draw any straight, solid line from flat promise chains to security. It's at best a "my preferred style encourages secure coding practices" form of argument, which is a weak form of argument, especially to put at the top of the page. Their callback-based async code examples also stand like straw men. Use some utility packages. async. run-{parallel,parallel-limit,series,auto}. When I hear complaints about error handling and callbacks, it's usually the opposite of what I read here. You end up with error-first parameters to every callback for every async operation. Linters like Standard will yell at you if you fail to handle an argument called "error". There's no chaining a bunch of promises with one `catch`, or wrapping a bunch of await calls in one `try`. The utility packages themselves take error-first callbacks.