They noted that it cannot be guaranteed safe. You can clone a specific version, and perform security audits on that specific version before deployment. Is it a lot of work? Yes. But it is indeed possible.