the funny thing about this is if everyone has the same cooldown, aren’t we back in the same boat?

sure there are other ways for the package maintainer to notice they were pwned, but often they will not notice.

The cool down isn't for end users. It is for package maintainers and scanners.