If i build a shitty house and it collapses, I own it, I don’t write a manifesto about how it’s all lumber’s fault.

If you sell the house in a high-pressure sales tactic way (“buy in the next 5 min or deal is off the table”) and deny inspection to the buyer before it collapses, that would be as close as this stupid analogy can get to the JS scenario.

As does FOSS C

Nonsense. As you were told, C is not dynamically fetched and spontaneously executed upon visiting a website.

do you install linux from the source tree and build everything yourself? no, you download an .iso, so you are bound to the whims of the OS maintainer,

Nonsense. Have a look at gentoo. You absolutely can build everything from source. You can inspect it and you can also benefit from the inspection of others. Also, look into “reproduceable builds”.

Literally every JS package I’ve ever used does this.

Nonsense. The web is unavoidably littered with unpublished JS that’s dynamically fetched every time you visit the page.