Packages or dependencies with only one maintainer that are this popular have always been an issue, and not just a security one.
What happens when that person can't afford to or doesn't want to run the project anymore? What if they become malicious? What if they sell out? Etc.
What if it's your bank's website? Or email provider? Or literally anything else you actually have to choose and can't pick? "It's okay because I don't think it affects me / I can ignore it" is always a bad reason to allow a bad thing happen.