It only works because packages are distributed via a carefully curated, centrally-managed repository with socially-enforced norms.