Fair enough, which is why I called out my assumption:).

I'm referring to the all hands on deck nature of responding to security issues not the best practice. For many, the NPM issue was an all hands on deck.