People tend to read them the first time when installing stuff, yet rarely think about the scenario of a well used package taken over by a malicious actor making changes.