Is the whole point of this not to ensure that someone can't use your identity to produce a compromised package? When I download someone else's code its my job

Is the whole point of this not to ensure that someone can't use your identity to produce a compromised package? When I download someone else's code its my job to make sure the code I run isn't riddled with spyware. Hence why I design my projects to rely minimally on external dependencies. Why should this burden be placed on the developer and not the user? If I buy a chainsaw and cut my arm off, is this the fault of the chainsaw manufacturer?