The difference is people have become conditioned to trust corporations and organisations, so the software/hardware you mentioned have people or addresses who mu

The difference is people have become conditioned to trust corporations and organisations, so the software/hardware you mentioned have people or addresses who must answer if they get compromised. Whether they answer is a different thing, and whether this is a good model for everyone is another question. NPM packages on the other hand are dependent on random individuals for integrity and society doesn't trust individuals as much as registered entities, especially profit making ones.