I guess the reason is to avoid punishing newbies for one that are doing baby's first NPM tutorials. The other problem is if you make a rule "reject npm package

I guess the reason is to avoid punishing newbies for one that are doing baby's first NPM tutorials. The other problem is if you make a rule "reject npm packages with only a single file called README". The spam bots will just add another fake file. This is a race to the bottom and requires far more aggressive fighting.