> meanwhile, everyone everywhere is npm installing and docker running without second thoughts.

Well... sometimes like, say, yesterday [1], there's a second thought...

  [1] https://www.bleepingcomputer.com/news/security/npm-package-is-with-28m-weekly-downloads-infected-devs-with-malware/