Yes, and my question is: why didn't they have them from day 1???

Or at least day 1000? Npm was launched in 2010, 11 years ago, and I'm quite sure immutable packages were implemented about 3 years ago.

Again, this is not rocket science, we knew the attack angles.