A package isnt even implicit authorization to run arbitrary code on other peoples machines. It’s authorization to run a specific, known version of your code, preferably one that others are also using without incident.

That’s the whole point of TFA: this is a design flaw in NPM, a package author shouldn’t be able to have the impact this event did, regardless of how popular their package is.