the "not your keys not your wallet" people will be delighted to find out that new npm package they tried out just drained their wallet. Or, absent that, that there are no modern onramps to cash in without KYC