Part of this comes to trust and who/where trust decisions happen. If I read the projects statement right, they think you should only load what you already trus

Part of this comes to trust and who/where trust decisions happen. If I read the projects statement right, they think you should only load what you already trust. The problem is that many people load things they just found on the Internet. Like `curl | bash` to random things people find. Note, if it's not obvious, `curl | bash` to scripts on the Internet is just as insecure as the current R implementation.