You are conflating bugs with malicious code. If somebody decides to deliberately create harm, intentions are very clear, there is no point in playing stupid to

You are conflating bugs with malicious code. If somebody decides to deliberately create harm, intentions are very clear, there is no point in playing stupid to turn it around into a bug, it doesn't work in courts, it won't work here either. There should be no place for this kind of immature behaviour in github/npm communities. Account suspension and reversal of harmful actions feels like adequate steps taken to protect everybody.