Writing a package manager is actually really serious business. This package manager runs under user credentials and is expected to modify the filesystem. You can't sandbox around those requirements. No amount of whinging avoids that. This story is one of many examples why you can't take it trivially.
If you're afraid to point out incompetence - and where it is most dangerous - you won't know it when you see it. And it will bite you, hard.