Safety critical systems integrators only buy computing equipment explicitly designed to be safety critical. That's a requirement from the system designer (or possibly the law), not the other way around.
If a nuclear plant designer go npm install random package that doesn't explicitly say it's not designed for nuclear plants no amount of lawyers will be able to sue the package maintainer if it fails.
Yes we all know EULA's contain a lot of moronic crap, just because Company A includes moronic things in their EULA should not be an excuse for Company B to include equally moronic things in theirs.