My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and have a significant adoption rate but are not actively maintained. We are talking about Colors-like and Faker-like projects. All you need to pull this off is posting one message asking nicely for permissions, post a commit, and make a release.
If you believe amusement is a disservice to the community then I believe many others disagree.
edit: For clarity, the "since inception" part is an absurd setup for the, equally absurd, "well funded open source" part.
There is an extreme lack of sense of humor around these parts.
I lol'd, and thank you for that.