Perhaps -- but not "definitely". It depends on what the frequency of each of those things is.

So far IIUC the frequency of critical projects being removed from pypi is 1 (in the space of a few days - although it came back), and account takeover of critical projects for malware publishing is 0 (in the space of many years).