I don't think I've ever seen the install instructions for a npm-packaged tool actually say to do this.

I don't think you're introducing new information. When I wrote my original comment, it was intended to fully acknowledge that this is what's at play. And rereading it, seems like it does that well enough, but I might be wrong.

But in any case, I'll run it with sudo then, is absolutely the wrong thing to do, regardless of the bad choices on NPM's part—on par with I just want to use my online banking, so I'll click through this certificate error, or I just want to take some notes, so I'll grant this mobile app the full permissions it's asking for.

There's a reason I used the phrase "normalization of deviance". It's a phrase that came out of post mortem investigations into simple process failures at NASA that led to proper (catastrophic, life-ending) failures, and an urge to find an answer to the question, "how in the world did we get here?"