And of course you can expect a visit from the Node police.
The node police ... they randomly wipe out your server. Or randomly uninstall modules so your app does not work.
that's just the new NPM version
No. They just give you a sensible, but stern, lecture about good security practices.
I'll take my chances
For what reason exactly? What point are you proving?
That he is working somewhere without the foresight to upgrade their apps off a legacy, unsupported and potentially insecure versions of node, or that he himself can't summon willpower to do it I guess.