> Also, the idea that there's no problem, because OS maintainers can just remove their package from pypi, totally ignores the point that that would be a really bad outcome for everyone that uses that package. I this that's actually a pretty big problem.

Is definitely not as big a problem as someone taking over their account and publishing malware under their name is.