If you're building a real world application, especially a server application like in the example, you're probably going to want to listen on the network, do some db access and write logs.
For that you'd have to open up network and file access pretty much right off the bat. That combined with the 'download random code from any url and run it immediately', means it's going to be much less secure than the already not-that-secure NPM ecosystem.
Today, right across Africa, governments are studying the possibilities of restricting foreign internet services. Both as a way of controlling the information their populations get to view, but also as a means of addressing high youth unemployment among educated workers by giving their domestic internet firms the room to take root. This is actually an interesting sideshow in the more global tendency towards balkanization. But take my word for it, young startup type guys from Entebbe-Kampala, (and, with AfCFTA, even places like Dar and Nairobi), will be very active trying to press their advantage.
The political side of this shutdown is predictable, but the interesting action is the long game. I think these kinds of shutdowns are dry runs for the sort of internet world African leaders are quietly pressing for in their future.