I believe that none of the billion dollar tech companies were affected by this in any way as they tend to have proper process in place for managing dependencies, the only ones who suffered were small developers and other open source projects which have limited manpower and just pull in updated versions without verifying them. Saying that this is an "existential threat" is ridiculous - megacorps can and do have procedures that won't be bothered much even if you'd have a case like that every single day.

Whatever his intentions were, acts like this threaten the open source community, but do not actually threaten the big companies at all.

This is such a bad take I don't even know where to begin. Please, read up on FOSS licenses and check which one colors.js uses. That's just the first of about five flaws with your argument.