> The impression I get from the companies I've worked at is to not trust packages that are mostly maintained by one person.

That is hardly the point. Regardless of what you think of the solution presented, the author is utterly right in saying any solution has to involve not trusting any packages at all. How many people wrote the package is irrelevant.