> The problem described in the post isn't the fault of package naming schemes

If PyPI used Java-like scheme with domain ownership verification, Google would presumably use com.google.* namespace for their private stuff and it wouldn’t be possible to introduce malicious package this way.

So the described issue arguably is a consequence of that.