I agree with you, but I do think the ease with which dependencies are managed in eco-systems like Ruby and JS is quite valuable. As most security-related things it's a cost/benefit analysis, and the benefit of the current systems are very high.

I do wish we'd move toward more of a system of forced MFA, GPG signed binaries, and a lot more conservatism on the part of developers before pulling in other gems. I don't think it's realistic to abandon it.