Maybe, but buying a domain and adding an email is not that much work, 2FA might be another story assuming it is being used. There might still be time for this to be exploited.

Thousands of npm accounts use email addresses with expired domains The Record by Recorded Future
https://therecord.media/thousands-of-npm-accounts-use-email-addresses-with-expired-domains/

>However, it is worth noting that days before this study was published in December 2021, npm announced plans to slowly start enforcing 2FA for developer accounts. This process was scheduled to take place in multiple stages, with the Top 100 maintainer accounts being enrolled in mandatory 2FA at the start of this month.