I was in a go tutorial a couple of years ago where the presenter was including directly from github.
And sitting in a ruby talk when the rubygems compromise happened just after everyone had been told to go upgrade a gem because of flaws in a specific gem.
It's not unique, but it is terrible.
Bower certainly isn't the only thing that does it. It's a trend that's becoming more and more common.