If a package is abandoned (i.e. there is no current maintainer), how is it determined if a package should be updated and maintained by Debcrafters or someone else?
Is there any kind of download metrics to know if a package is used?
How would package maintenance be prioritized?
If the package is in Ubuntu Main repository (https://ubuntu.com/blog/ubuntu-updates-releases-and-reposito...), it is maintained by Canonical engineers for LTS. Ubuntu Universe gets security fixes for up to 10 years as part of the Ubuntu Pro offering, which is where most of the upstream Debian packages are.
A package from Ubuntu can be removed using the following process, Anyone can file a request. https://canonical-ubuntu-project.readthedocs-hosted.com/stag... (note: the url will move to documentation.ubuntu.com domain)
Debian also has https://qa.debian.org/popcon.php?package=openssl, but it does not mean that a package with very low popularity should be removed.