If a malicious actor has access to change the npm module (therefore can change the public key used to verify the module code signature), how does signing code help? Now the malicious actor is signing their malicious code.

Code signing still allows the fire to spread. What we need to be talking about is how to prevent the spark that starts a fire.