I don’t think there are malicious intentions behind winget. Aside from the fact that it’s objectively useless for server configuration, Windows Server lost to Linux in terms of performance per dollar a long time ago. The target use case for winget seems to have been spinning up new employee PCs, but I’m not confident that it would be wise to use it for that.

It’s also shockingly simple for a package manager. Nearly all of the “packages” simply download the software’s installer from the official website and silently execute it. You can see (and add to) all of the package configs here. It’s literally a GitHub monorepo lmao

Edit: here is the one for Steam, for example. The whole thing is 63 lines of yaml.