> Really wish the norm was that companies hosted their own registries for their own usage

Is this not the norm? I've never worked anywhere that didn't use/host their own registry - both for hosting private packages, but also as a caching proxy to the public registry (and therefore more control over availability, security policy)

https://verdaccio.org/ is my go to self hosted solution, but the cloud providers have managed solutions and there's also jFrog Artifactory.

One corollary of this is that many commercial usages of packages don't contribute much to download stats, as often they download each version at most once.