Comment by olalonde

That's security theater. The package can still run arbitrary code the moment it's actually used.