it could be. With the legit package named with a misspelling on purpose, users may confuse the correct spelling 'request' for the real package. in that case the typosquatting attack would actually not be a typo at all! You can't identify this attack by just looking for correct spelling, which is OPs point

It's just humorous that in some packaging ecosystems a typo opens you up for a vulnerability, where as in other packaging systems, the more official packages are intentionally given weird names.

Squatting is a problem as old as [NSFW] white house dot com versus [official] whitehouse.gov from the 2000s