> you won't find us loading arbitrary JS from a random GitHub user's account

You load arbitrary JS from a random GitHub user's NPM package. What's the difference?

> Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account.

You'd be surprised how many apps inside have hacks and workarounds because deadlines.