My understanding is that for most package managers the signing keys are held by a smallish number of maintainers responsible for entire sections, who presumably keep those accounts pretty tightly secured. Not impossible to take over, but it’s a smaller attack surface.

While for NPM as far as I know every uploader keeps their own account and there’s not even signing keys to lose control of.