If this continues into the long-term without solution, I suspect paid package repos will start making an appearance, whereby only vetted versions of components are available.

At least one big company already maintains internal clones of repos with registration of every version of every component used (I know this through personal experience) and I have no doubts the others are doing the same, especially if they are into cloud or government contracts.