That's correct, orphaned packages could be adopted seemingly automatically, so someone did and then published malware in bulk.

This makes me want to adopt more packages. Lots of the orphans barely need updating.