Yeah, I was being overly security minded and thinking only about the threat of someone taking the name and replacing the package with a malicious one, not the b

Yeah, I was being overly security minded and thinking only about the threat of someone taking the name and replacing the package with a malicious one, not the breakage caused by the package disappearing in the first place. In the former case, if the maintainer deletes their GitHub account, it matters whether someone else could register the same name. But of course you're right that Git repos are far more vulnerable to the latter too, unless you fork.