Sure. And people shouldn't steal people's credentials and publish malicious artifacts, yet here we are.

Just because you expect people to behave like X doesn't mean they will. In this case people will automate packaging of artifacts.

NPM was a third party manager (it's not part of EcmaScript nor was it part of Node.js at start) and so is Maven. Reputation matters more than origin.

Those who do not know history are doomed to rediscover it.