alt Hacker News> If the customers had been handed the software on day 1, by day 100 it would be full of security bugs, would need to be re-written for the new version of Node.js (the old one having been deprecated and also full of security bugs).
We don't have to make everything a javascript app running on the open internet. Though even an insecure node server could be perfectly fine if deployed on the corpnet behind a VPN...
Thats a very spicy threat model post the age of IoT.
Any stray device you may not even be aware of can rip that assurance apart.
A fully locked down network can in theory enable this however, very few enterprises actually are strict enough for this to be enforced across the whole network.