Of course! That's good engineering. However I argue that the default is far too often to use something 'off-the-shelf' and trusting it A) works, B) is secure, C

Of course! That's good engineering. However I argue that the default is far too often to use something 'off-the-shelf' and trusting it A) works, B) is secure, C) is supported, and D) will remain so for the lifetime of your project. I wonder if those who say "2 days?! Just npm install!" answered those questions, or if they googled "nodejs fake data generator" and installed it onto their businesses main product in the next 5 minutes.