That’s there’s only been a few problems like this despite millions of users is a sign of strength.
I hedge by pinning yo specific versions and keeping my own package manager (RStudio) to keep mirrors if the packages I scan. That the packages are open source means they are easier to scan or fork.
If a maintainer stops then the project can be forked. If nobody wants to fork then that probably means no one cares enough. And that’s ok.
Mostly it forces us to be flexible. I don’t think software is a thing but a process or cycle.
If a thing has an expiry date that is >10 years, then you're not going to see any problems for 10 years. That doesn't mean the expiry date doesn't exist, or that the thing won't hit it. It can be wildly successful for all those years and then hit the expiry date and stop immediately.
I’ll take a decade of success as a sign of sustainability over a package maintainer losing their shit as a sign of h sustainability.
The big question is what happens when a maintainer wants to retire and a successor can't be found? Or (as in this case), when a maintainer gets so annoyed by their users that they refuse to continue co-operating with their user base.
We don't really have an answer for either of these questions yet, and we won't bump into them until maintainers get old or angry. But we have been predicting that this problem will happen.
Now we're bumping into this problem, it's our new reality. What's the solution?