> you can calibrate your trust in their ability based on reputation, track record

rarely. How many of the libraries you pull from package managers do you actually know the authors of?