Fatal error in RecipeActivator::getPath() if the package is not physically installed

While working on improving my Gitlab project_browser source, I find it throws an exception if the project type is ProjectType::Recipe:

The website encountered an unexpected error. Try again later.

OutOfBoundsException: Package "vbouchet/te_security" is not installed in Composer\InstalledVersions::getInstallPath() (line 241 of vendor/composer/InstalledVersions.php).
Drupal\project_browser\RecipeActivator->getPath(Object) (Line: 71)

here is the getPath method:

  /**
   * Returns the absolute path of an installed recipe, if known.
   *
   * @param \Drupal\project_browser\ProjectBrowser\Project $project
   *   A project object with info about the recipe.
   *
   * @return string|null
   *   The absolute local path of the recipe, or NULL if it's not installed.
   */
  private function getPath(Project $project): ?string {
    if ($project->packageName === 'drupal/core') {
      // The machine name is the directory name.
      // @see \Drupal\project_browser\Plugin\ProjectBrowserSource\Recipes::getProjects()
      return $this->appRoot . '/core/recipes/' . $project->machineName;
    }
    $path = InstalledVersions::getInstallPath($project->packageName);
    return $path ? $this->fileSystem->realpath($path) : NULL;
  }

I am wondering if it even makes sense to check for "installed recipe" given a recipe is only "applied". However, I understand we are not really trying to know if a recipe is installed but more to find its local path. Maybe we just need to adapt the wording of the method doc and catch the exception to return NULL.