The difference is that I expect "npm install" to execute code, where I do not expect merely opening a repo to look at the files in Cursor to execute anything.
In most languages, none of those things involve execution of code in the repo. In languages that do - for example Elixir - it prompts you to trust them first.