> But any dynamically fetched code/modules/packages will suffer the same risk.

A package manager usually employs signatures. In that case, the problem could have been avoided (unless the signing process itself is also compromised, then you're out of luck).