Not to mention when your operating system likely updates itself, when you import new dependencies from a repo, when any software is updated to a new version by any means other than the user recompiling from source, etc.

It happens all the time but for some reason, it's more evil when it's javascript.