How do you prevent hostile takeovers? That's the core issue here.

Owner X died and the next 6 contributors don't care about the project. Here comes Ron, with his 3 PRs from 2020, suddenly able to publish releases as if X is still here.

There are so many dead projects where the author doesn't even care to assign the next person, what do you do then?

I think forks are the best thing we got at the moment, with potential for some social bidding at the package registry level ("I vouch for Ron to take over the package, as I'm a known FOSS contributor")