point is that npm are encouraging you to use npx, which is bundled with npm 5.2+ as a general tool for executing adhoc commands from the terminal. It just massively increases the chance of typos.
`npx` doesn't change that dynamic. It's no different than installing an RPM or Debian package over the internet.
I know my systrems system wouldn't last 5 minutes.