You can pin versions. If you aren't, you have the same issue with regular npm.
You can, but you won't. Let's be real for a second now - the only reason you use this feature is because you can't be bothered to use a real package manager that pins versions.