Earlier quoted context omitted.
Maybe that's the problem? The file format is too loose and it shouldn't allow arbitrary content anywhere.
This seems like a situation where npm can't win. If it only allows npm-specific information in the package.json, then people will complain about how they have to have 10 different configuration files in the root of a JavaScript project. If they allow arbitrary configuration, it's blamed for being too permissive.
There are other possibilities. They could have a registry for allowed keys, or allow them but only under "extensions".