I’m not at all confused about the obligations.

You seem to be confusing requests and demands.

PyPi requests that you take certain steps once your package is deemed critical. If you don’t, they prevent you from releasing new versions.