I don't see how any of these reasons are why npm is "fundamentally insecure" any more than any other system involving humans.
The maven world, by contrast, is habituated to fixed version numbers for dependencies. A fake release might affect folks downstream that explicitly choose the upgrade, but it won't be automatic.
package-lock.json helps solve the technical problem, but the JS community still has a cultural problem because JS packages are typically fine-grained, released frequently, and upgraded without much thought.
One of the many things the npmjs.com website needs to do is provide a code viewer for each version of a package. It's a bit annoying that you have to unpack a tarball just to see the code you're going to be running if you install it. Right now everyone just takes for granted that if a NPM package links to a Github repo, that that's the code you're going to be executing.
Nothing is going to solve the explosion of transitive deps though without some sort of cultural change. I don't see that ever happening. I do like the ecosystem of tiny libraries but it's too large of a trade-off for security sensitive applications imo.
Just the other day I caught myself feeling frustrated that I had to manually add a dependency + version number in my mix.exs (Elixir package manager), just because I got so used to doing 'yarn add <package>'.
And that's despite the fact that I for quite a while now I have also been feeling a bit weird about just adding packages to my project for the exact reason discussed here (as well as the 'leftpad' fiasco).
It's both fascinating and a bit scary how easy I just do things 'the way everyone does' despite knowing better, and I hope we'll find some solution that could be applied community- or ecosystem-wide.
Even just simply forcing 2FA would be a significant improvement.