npm didn't historically do lock files either, thus is was easier to update npm packages unintentionally. npm is also a worse designed cli, just executing npm w

npm didn't historically do lock files either, thus is was easier to update npm packages unintentionally. npm is also a worse designed cli, just executing npm without any arguments and it will start installing regardless of where you are in the filesystem.