Yeah, I don't disagree there should be more of a barrier, I remember being surprised I could just adopt things. Just explaining the intended use.
There's also no KYC process for creating one.
There is more risk in someone adopting something with established users though. Some people (cough) might be a bit less careful if they see something has tonnes of users, votes, comments; people actively using and liking the package.