I think it would be a no brainer for npm to offer this but idk why they haven’t

Probably because they would expose themselves legally? Not sure what the current situation is exactly, but I assume it's "at your own risk".