I completely agree with the developer here, I also think npm crossed the line by republishing the module.
It seems to me that once published to NPM there should be some process for deprecating a module that is then "unpublished"... rather than just breaking every module that uses it as a dependency instantly.
They could spawn automatic emails to all dependent module owners about the hard deprecation and give them 7-30 days to replace the module before it's removed from the package ecosystem.