Since the last several iterations of emacs have emphasized package management from 3rd parties, I doubt most new or even experienced users are looking in to if someone slips through malware in an update or a similar package to a popular one like has happened with npm