1. More or less. They all suck in a similar way and often fail randomly. As you may notice, my experience wasn't good...

2. This is not a good thing in terms of security, long-term stability, and quality in general. But there should be a two-level system where you can upload easily so that other people who are careful can explore but then there should also be a quality controlled system like apt.

So yes, both points are true but I feel cross-platform package manager should be based on apt or similar with multi-level quality control, and npm, pip, and cargo and other low-quality attempts at package management should die IMHO.