It is somewhat unfortunate that tar has two main purposes with very different threat models, namely backup and (software) distribution.

The POSIX standard promotes best-effort extraction, which is reasonable for backups, but a liability for distribution.

Julia's Tar.jl was developed for Pkg.jl and tar-codec for uv, so these are focused on the security aspect of software distribution.