You can also question why browsers allows it, why curl allows, etc. Composer is a tool. It is not a judge. If users wish to take risks, that's their business. My only concern is making sure the tool doesn't make the wrong choice by default.