A lot of the maintenance of these packages is performed by volunteers. Putting, however well-intentioned, barriers up will often result not in a more secure maintenance process but no maintenance at all. I'm generally happy to donate my patch that fixes an issue in a package I use, but that's not going to last long in the face of demands that I jump through hoops prove my identity (my interest in the following the bureaucratic procedures of an organization is closely related to the amount of money they are paying me). Particularly since my experience has been that organizations that are anal about that sort of confirmation tend to be more interested in passing any legal liability on to me rather than maintaining a secure maintenance process.