Because security companies/researches are doing just that. The vast majority of recent supply chain attacks have only lasted minutes to hours. A large portion of them were credential losses or tag takeovers that aren't hard to detect, but by the time you do, your CI/CD has already downloaded and ran the attack 200 times.

Actually, you make an excellent point. Account takeovers have been responsible for a number of recent high profile attacks. Even if there are 0 security researchers reviewing new releases, just having time for the real owner to announce that a release was fraudulent before it's downloaded by half the Internet is a huge boon.

This entire article seems to say that if it doesn't prevent 100% of all possible attacks that it's "security theater". That's nonsense. It's just one more tool in the tool belt, and a highly useful one at that.