Same thing with NPM/PIP dependencies (they can launch arbitrary code and clean up after, unlike Java deps from maven that just copy immutable archives).