Uncalled for ? Really ?
With the amount of people who just include a library on GitHub and never worry about what it actually does until said library falls over, it's not really uncalled for.
Personally, where I to include someone else's library, I would import it into my code stack, review the code to ensure that it does what it says on the tin and nothing else, and - after testing the thing to hell and beyond - include it in my production code stack.
Of course, it is then up to me to set a watch over that library to check when it is updated and what the update is, but that's my problem.
The rub is, developers hate problems, so they just link to library and let history run its course.
It's not because, in this particular case, developers had no way to avoid the issue that the argument does not stand.