Why isn't running npm audit enough on its own?

Short interview answer

It lists known advisories against installed versions, but many findings aren't exploitable in your usage (a vulnerable code path you never call) and it misses malicious packages with no advisory yet. It's a triage input, not a verdict, and needs human judgment about real exposure.