> Are you really going to read through every single directory in node_modules/ to make sure you know exactly what you're running?

What, you don’t? Each dependency comes with a license notice. Everything needs to be pinned. The npm mess that comes out of pinning and unbounded versioning is precisely why we steer clear of it.