I'm trying very hard not to get into a fight on github after being told that a package manager should implement _mechanism_ not _policy_, a canard I haven't heard in probably 15 years.
Deciding not to set safe, reasonable defaults is an abdication of responsibility. It's negligence. We've tried doing it that way and we just know that now.