You don't need to force everyone, both an coexist in this context. I do believe a company with nearly a trillion dollars of planned expenditure can afford to buy a domain and renew it prior to expiration.
Also, a basic scan of the package would have flagged an ssh backdoor, no? It didn't seem to me like its obfuscation was very sophisticated.
Scanning is a curious one. It's not always obvious because developer tools have legitimate reasons to do a lot of these things. LLMs are better at understanding what it's actually doing now though so that might have worked. But who knows, people have snuck in backdoors into many things before.