I somewhat agree because the main package file .eg package.json can act as a lock file if you pin packages to specific versions
https://docs.npmjs.com/cli/v11/commands/npm-publish
> The publish will fail if the package name and version combination already exists in the specified registry.
> Once a package is published with a given name and version, that specific name and version combination can never be used again, even if it is removed with npm unpublish.
I was talking about tags above, eg. "npm i react@next", and you can use tags in your package.json. npm allows you to republish them at will, and you can never force your users to use a specific version.