Perhaps they are referring to the fact that the package server does not hide the email of the contributor?

Not that this is a complaint worth airing on HN.

Solution: just block the alias that you use for the submission…