All the "first one who asks for the name gets it" package managers suffer from problems (some of them security-related) that anything that talks to Maven Central does not.
If you want an account on Sonatype's OSS repository (which allows you to push to Maven Central), you need to prove that you have control of the domain you want to use (in reversed form) as the "group ID" you publish libraries under (IIRC, by setting a TXT record in DNS). Meanwhile, to publish to crates.io, you just link your GitHub account (which is required, gross), and then you can publish to any package name that hasn't yet been taken, and then it's yours, forever. That seems terrible, somehow.
(Granted, that just covers the group ID for depending on the library; you can put Java classes in that library wherever you want, even in "other people's" namespaces. In practice, though, I don't think this ends up being a big issue.)
(Also granted, if you let your domain registration lapse, someone else could snap it up and possibly hijack your namespace. But I wouldn't be surprised if the Sonatype folks would try to get in touch with you if someone else tried to claim your namespace, even if they had control over the domain.)