Attack surface, stdlib is one library... packages tends to be hundreds if not more of libraries. Much easier to take over a package than a stdlib.