As far as I know common targets for malicious packages are crypto (mining, wallet swiping), and credentials (SSH, package repositories), none of which is limited to businesses. There's been some cases of politically motivated sabotage lately but mostly from the maintainer themselves so far - expect more of that though.

Often a compromised package will try to steal more credentials from downstream users. [1] I don't doubt that threat actors all the way from script kiddies to nation states are keeping a stash of credentials to package repositories, and it's going to suck for everyone when they decide to use them.

[1] https://www.bleepingcomputer.com/news/security/compromised-j...

The high-profile NPM package compromises in recent years have mostly targeted hobbyists/been indifferent to who they were targeting. Crypto miner malware doesn't care what computer it's installed on.

That is just entitlement on the part of some open source devs. PyPI is already providing a huge service for them: it is publishing their package free of charge. Furthermore, it is maintaining old versions, scanning others for vulnerabilities, replicating across the world, resolving dependencies etc. They have every right to ask anyone who is enjoying their completely free service to put in the minute amount of extra work required to set up 2FA.

Of course, anyone is also free but to want to put in that work, and so they can stop delivering their package on PyPI. Absolutely your right as an open source maintainer, and you have no one to answer to if that breaks some builds.