Security is about risk reduction; like creating an ordered list of measures that reduce the most risk for the lowest cost. Working on stuff outside of the top

Security is about risk reduction; like creating an ordered list of measures that reduce the most risk for the lowest cost. Working on stuff outside of the top 99%+ of effective solutions deserves to be questioned. As an alternative, they could have been investing time in a form of capabilities-based security for packages like Deno has where not every pip package can spawn info stealer processes at install time or runtime. That would address both the build compromise attacks and actually-common attacks like vulnerability exploitation.