I think there needs to be a counter effort against these people. Some entity like the EFF should maintain a database of people who have engaged in protestware so that there can exist APIs which will check for whether any of your dependencies come from these blacklisted people... or if you are about to hire them.