One thing stopping us adopting unlocked packages is the poor security around the hosting of the package version.
Performing a package create and version on the cli publishes the unlocked package to Salesforce servers with the installation protected only by a password.
In organisations with reasonable security controls around code leakage this seems unacceptable.
Anyone with a url and password can get the package code.
Has anyone seen an alternative or roadmap item that fixes this?