As a node developer, I've learned the value of shrinkwrap the hard way. I imagine many companies don't use it until it comes back to bite them.

I've had to deal with downstream dependencies breaking things in our dev environments more than I care to admit. I'd suspect that most old node projects of any meaningful size won't just boot up and run without some tinkering.