This still does nothing to prevent anyone from publishing a bad package, for example a compromised device/dev in the organization.

A cooldown of a day, and maybe not updating on weekends will save you from that.

It's time to stop moving at the speed of stupid.