Who could possibly have predicted that a package manager anyone can submit anything to would be problematic?

Mobile-addicted. Web-dependent. Digital plumber. Nerd. He/him. No-coiner.
Who could possibly have predicted that a package manager anyone can submit anything to would be problematic?