Isn't a major major point that package registries and or modules don't need review board? thus eliminating gatekeeping?
The database / infrastructure could be permissionless and you could still define curated subsets of functions in addition to that.