What stops a package developer to become a maintainer as well (even under another name to keep the blame to that identity only)?

It just tends to work better in managed repos but the problem can still easily be poked.