Edit: I checked the page's code and it does indeed set the units based on language. If your language is "en-US" you get imperial by default, everyone else gets metric.
What’s needed is an entitlements system so a package you install doesn’t do runtime stuff like install crypto mining software. Even then…
So preventing lifecycle scripts certainly limits the number of packages that could be exploited to get access to the installing machine. It's common for javascript apps to have hundreds of dependencies, but only a handful of them will ever actually run as code on the machine that installed them.
Do we? I was under the impression that CRTs were not being manufactured anywhere anymore. I could definitely be wrong, but I couldn't find anything with a quick search.
I'm not a huge fan of working in WSL, because I actively dislike the Windows GUI.