The problem with using downloads as a proxy for "safety" is that a bad actor can use CI infra/bots/scripts to inflate the number. This is why in Packj [1] we check for multiple attributes (e.g., dependents).
We're working on making it similar to email spam. Will post more soon. Meanwhile, we welcome changes that can make it less noisy for the community.
[Edit:] one can specify Github API token to get around rate limiting. We'd deeply appreciate if could create an issue for this on the repo.