There’s two things at play, here:

• installing dependencies without checking
• a framework that will allow this

Both are absolutely the fault of the user.