I roughly agree. I guess it would also incentivize some weird behavior like buying a project to take it private and try to extract value from users of the tool

I roughly agree. I guess it would also incentivize some weird behavior like buying a project to take it private and try to extract value from users of the toolchains it's been built into. This would be marginally better than buying a project to inject a backdoor or malware per instance, but it might be a lot more common? (It seems to be much more compatible with existing ~vulture-capital behavior.) It would probably be Bad for most maintainers if our dependency chains were regularly being roiled by someone taking a package private.