I know the crates.io maintainers have stood their ground on not namespacing crates.io (as compared to Maven or NPM), but it really feels like a sunk cost to keep going with the global namespace. It wouldn't necessarily have resolved this situation, but they would have to at least typosquat both a user and crate identifier. It feels like too many crates have to squat their own pseudo-namespace, and all bets are off as soon as people start making middleware on top of a crate.