> But honestly, the amount of work we'd all need to put in to truly prevent this from happening again... it's just never going to happen.

To me this is the irresponsibility of the NPM maintainers. Require some kind of cryptographic proof you intended to change the code. Signing or TFA or we wont host your w̶o̶r̶m̶ code ...