> ...and a security nightmare where everything is pulling in tons of random NPM packages with 4 GitHub stars.

To be fair, this happens with React too (all the time). It has more to do with the JS ecosystem than with the framework of choice.