In the real world, do wealthy companies want to be named on this list of 3 or 4 groups spamming NPM? That’s a lot different than being seen buying a banner ad.
So, similar to Twitter's blue check mark - Yes, asking a "small fee" adds friction, but it's not an obstacle to the wealthy.
Unfortunately, that last one deserves a special Fuck You to the main developers of FileZilla, who have knowingly bundled malware for years. :(
For anyone that doesn't know about it, here's a forum thread about it they haven't deleted: