That's mostly unintended FUD (but still FUD) or problems that can be worked around:

<< - Is unstable because if a dependency/host goes offline, all users are broken instead of an internal build being broken (think leftpad but much worse as your users are instantly impacted, likely before you even know about it) >>

So you don't recall Leftpad?

<< - Is insecure because if a host is malicious, they can choose to supply different packages for a small subset of the requests, such as those coming from govt. requests against political targets, hosted build machines, etc. and nobody will have any way of knowing because there's no lock file/integrity hashes. >>

Are you kidding me?

https://www.zdnet.com/article/microsoft-spots-malicious-npm-...