That would be a big improvement, but I assume that people would override this check whenever they were updating a package to fix a minor accidental vulnerabilit

That would be a big improvement, but I assume that people would override this check whenever they were updating a package to fix a minor accidental vulnerability that had been found in it (detected by an "npm audit"). An attacker who had control over an account would wait until just such a moment to add their own version which includes a much worse payload, and people would rush to download it, thinking they were just installing a fix for the minor vulnerability.