I think pretty much all developers run random code willy nilly. People don't check the stuff they install through their package managers nor the dependencies of those packages, except the most anal ones.