"In hindsight it's likely that all they wanted from the purchase was AI training material."

Microsoft already owned GitHub. I don't see how acquiring npm would make a meaningful difference with respect to training material, especially since npm was already an open package repository which anyone could download without first buying the company.

Not all NPM packages are hosted on github. I don't know what the number is, but I know I don't have my NPM packages on github (instead, bitbucket).