It just wasn't my day, and we put a lot of effort into it, so being told that I said it does not matter kind of set me off a bit.
Anyway, lock files and package integrity verification have been pushed, there may still be a few details to iron out, but it seems to be working so far. Let me know if you find something that looks wrong or if you think about anything that is missing.

you can’t just go “oh those don’t matter because I’m not being paid”

Well, 1) any of us can do whatever the fuck we want (even releasing broken software) and 2) it seems pretty obvious to me that downloading from the official registry is a thousand times safer than thinking everyone will just make sure beforehand that they trust everything bundled with some project they want to run because there's a nice warning in the documentation saying so. It's just as effective as saying, don't do drug kids, it's bad.

I've never said it does not matter, like never ever, read me again. I even told you about what's planned, I could have just told you I didn't give a damn and to go screw yourself, too.

Absolutely, there are preliminary work on package integrity verification it's simply non-food paying work as you can imagine but it will be committed anytime soon.
I know lock files are done by now, it will just take few more changes to have package integrity verification aswell.
We just didn’t expect people to want a full-featured package manager right away, but it’s going to happen.
Thank you for these wise advices, and again, you're more than welcome to join if you find time!

Selling? It's free software mate lol
No addon depends on each other yet, we're fine we got plenty of time to fix a week old projet
If you want to stand out, you can do so here and just so you know, commits are coming 😘

What prevents bad actors from changing stuff under the hood?

You'd have to hack into the asset store and upload another zip archive there to update the official registry, I guess 😄

verifying via checksum could be helpful here

Indeed, lock files and checksums are planned
It's still in early development and if you can help with any of this please suggest changes on the repo

Also if you're into decentralization you can own your manifest