> So I really hope you don't pull in packages randomly. That sounds like a security risk.

It absolutely is, but that is besides the point

> Also, good packages tend have a team of people maintaining it. How is that the same exactly?

The famously do not https://xkcd.com/2347/