I only said it is a defense-in-depth measure.

I definitely want to know how is it worse than running npm directly on the host