Licensing your code under an open source license is not the same thing as giving up ownership of your code.
Here's an example where a huge open source project must get permission from every coder who ever contributed before they can make a change to the licensing.
GitHub has always owned 100% of the project from the day the developer created their account. The developer owns the code, yes, but the account itself and the actual GitHub project structure is 100% owned by GitHub. From a legal perspective, it is a 100% GitHub-owned project that's a derivative work of the developer's code. Legally, the website is a derivative work, and derivative works are owned by the creator of the derivative work, not by the owner(s) of whatever the work is derived from. There are restrictions on what the owner of a derivative work can do based on the licensing of the original work (for example, GitHub can't merge GPLv2-licensed code and Apache2-licensed code hosted on their platform) but GitHub still owns the derivative work entirely.
For example, if I were to stand up a website using Apache httpd using PHP and Drupal, then the website is 100% mine but it contains code owned by the Apache Software Foundation, Dries Buytart, and Zend Technologies. None of those three have any rights over my website, even though they own the code I built it on. I still have to respect the licenses to the code I use—I can't make my own fork of httpd containing code I copy-pasted from a GPLv2-only project, for example—but the website is still my website.
Or for a non-code example, let's say I were to write Lord of the Rings fanfiction. As a derivative work, the fanfic is 100% mine even though it contains characters copyrighted by the Tolkien estate. I can't legally distribute my fanfic to people without getting a license from the Tolkien estate (but thankfully the Tolkien estate is willing to look the other way), but it's still mine, and the Tolkien estate can't just yoink my fanfic and publish it in an anthology unless I give them permission either.
NPM/MS/GitHub are distributing code consistent with the terms of the license provided to them. The developers (current lack of a) relationship with his (former) service provider doesn’t have any bearing on that.
If one doesn’t way service providers to distribute code they’re licensed to if other relationships are terminated, one should include those terms in the license under which they rel,ease their code.
Here's an example where a huge open source project must get permission from every coder who ever contributed before they can make a change to the licensing.
https://blog.llvm.org/posts/2021-11-18-relicensing-update/
This coder chose a license that allows you to fork and modify the fork. That does not give you the right to seize the project and change the original.