A single Node of failure

There is a difference between a security bug and a deliberately put exploit. Npm model protects against the former as it makes it trivial to update after a bug is discovered via running a single command. The price for that is that it turns npm into a vehicle to deliver an exploit right into thousands of developers' computers.

Compare that with a model where all dependencies are explicitly copied into the source tree. Surely it makes it harder to upgrade especially if one manually applies patches for security bugs. But then one avoids exposure to deliberate exploits as the delivery is simply not there.