...by adding a single point of failure?
No, my thoughts are that we need better mechanisms to validate our dependencies.
So far I believe that Maven and NPM have failed to deliver on that front.
The dependencies being resolved from the code store provides a decent mechanism to resolve that issue.
But as long as it's being done on closed software, it's going to be hard to move towards a standard.
I share your concerns, but I've also long had the feeling that both NPM and Maven are a security disaster in the making.
Having the dependencies being published from the same place that stores the actual code, gives me a little hope that things will improve from the security and design perspective.