That is sort of how Chocolatey works already. You can modify any of their abandoned packages and submit a request to become owner. They still need to have admin

That is sort of how Chocolatey works already. You can modify any of their abandoned packages and submit a request to become owner. They still need to have admins or package authors maintaining packages though in order to ensure the hashes are correct. Otherwise if anyone can make a change then it will become ripe with viruses and malware.