It's just a URL right? So could you not mirror the packages to your own server if you're so concerned, or better yet import from a local file? Nothing here seems to suggest that packages must be loaded from an external URL.
And this is different from NPM how? Except that I've now lost all the tooling around NPM/Yarn.
Not saying Deno won't devolve into this sad state at some point. Maybe it already has. But it seems to try to combat some of the problems by being honest and pragmatic about dependencies, promoting minimal external tooling and removing some of the dangerous abstractions from NPM.
To me Deno seems like a desperately needed and well thought out reset button.
Semi-related rant over.