Begging the question of why the vulnerable version is still available to be grabbed in the first place?

Deleting them would break builds ;)

this, companies who are hosting known vulnerable libraries should be charged criminally imo

That's one of the open questions. YES. Absolutely.