After latest security incidents in October and November there is discussion started about making npm install scripts opt-in.
Right now we use this hook to locate chrome locally or download it if it hasn't found. If it was found, we save its executablePath in chrome.json.
But, we probably can move this operation from install stage to first launch stage with same logic.
Although my npm account covered with 2fa, I think it won't be a mistake to investigate this opportunity.