Wouldn't `npm unpublish --force` revert this? If you provided an email you'd get a notification about a published package so you'd notice immediately even if you didn't at first.
For the original tweet's company, there was probably some kind of incompetency involved in not noticing that the code was public for years. But I can't comment on that further as I don't know the circumstances. I only wrote my anecdote about the accidental publishing side.