Again, they are run only when you run those commands explicitly on the packages in question. The only reason you would do that on code that wasn't yours was is if you were developing on a forked module, which should be trustworthy, or you've at least read it's code.