Ideally, names could still change hands, but it would require a major version bump. So I publish 'google-lib' 1.0.0, Google files a trademark claim and is given publishing rights on the 'google-lib' package, but only for versions >=2.0.0. If a company still goes after you for hosting the archived code, that's when you make a legal stand and try to get EFF involved or something - because there's zero case for "reasonable likelihood of [trademark] confusion" over a deprecated version of a package which is only available via 'npm install'. I would expect this to never/rarely happen.

The harder question is what to do when you get a valid copyright claim, ie. when someone publishes code that wasn't theirs to publish. I think in this case, immutability doesn't really work, and you'd have to retroactively remove all versions. This should also be fairly rare, especially since so many packages are <500 lines of code.