The point that the parent commenter is highlighting is that if somehow a malicious package version is introduced, since nobody actually is auditing the changes that are being pulled in, it is possible for the tests to pass and introduce a security vulnerability. They're suggesting that the contents of the actual diff in the packages should be reviewed.

I believe the OPs point wasn’t that that’s what we need—it’s that that’s a bad idea. It’s insecure and bound to break things eventually.