Absolutely, a package manager server should state in their license file that when you submit a package you consent to it being cached on said server.

Having someone remove a package and breaking a ton of other packages is nonsensical.