I fail to see how decentralised package sources can possibly reduce the chances of a supply chain attack (from outsiders). Now instead of one repo needing to be secure and up to date, thousands must.
Edit: along with the authors own blog explaining their take: https://kerkour.com/supply-chain-attacks-and-backdoored-depe....
The short version is, it's better to have a centralised (though proxyable, and opt-outable) central store of hashes of module content, but then provide flexibility over distribution. The concern is that a central package manager adds complexity and opportunity for security vulnerabilities without adding much value.