You have to blame the designers of the language back in the 60ties of last century.
it was even an ANSI Standart then.
And it is backward compatible and the code of the 60ties still can run unchanged!

it's an interesting line:

patient0 = Patient.parse_obj('familyname',given='givenname1').first().serialize())

I miss some checks if the search was successful.
Because NONE indicates a missing content.
If search(family='familyname',given='givenname1')
fails you receive NONE and this can't be serialized.  
COS would just return NullString """

  • if you have access to the CSP or ZEN page you may just check the user name in method OnPreHTTP or similar, and redirect him to the moon.
  • if can't touch the page then rename it and create a filter page that does a server-side redirect for everyone except the banned user. .

Fully agree:
Package was used for the chapter of OEX from day zero!.
Instead of semantic discussions, it would be much more important to take care of 
quality and completeness and easy-to-evaluate examples for the community.
Every member of the community is a customer. To my understanding this is major
point of being different do other code exchange and discussion platforms.
I have checked almost all packages (except the commercials) and most contributors 
seem to share this understanding. Though I have to admit that there are also less
service-minded contributors that just don care about issues and PRs.
A community of white sheep only is an illusion.
I've seen too much to have such dreams 

You are correct module.xml indicates IPM/ZPM usage and that's OK.
But "Packages" is much wider since it also includes those parts that do not contain installable code or data to load but (if well prepared) a bunch of additional information like (hopefully) user guides, installation guides, description of the purpose of the packages, as well as screenshots, examples, ..... 
All this is not part of the IPM module. for good reasons.
I would feel "module" as a downgrade of the excellent work the contributors provided to the community.

in iris.script for NSP %SYS add

set par("AutheEnabled")=64
set tSC=##class(Security.Applications).Modify("/csp/sys",.par)

the disadvantage:
You are UnknowUser and might need to add the required Roles as well.

set role="%All"
set tSC=##class(Security.Users).AddRoles("UnknownUser",.role,1)

my personal approach is to have a fixed port for SMP
and save my   _SYSTEM / SYS in browser with autofill.

this shows how $QS could be used for a partial global listing
it only checks the second subscript and writes the value for a match

SAMPLES>k ^rcc
SAMPLES>f i=12:1:19 s ^rcc($j,i)="SUB1=J,"_i
SAMPLES>f i=12:1:15 f j=14,17 s ^rcc($j,j,i)="SUB1="_j_",SUB2="_i
SAMPLES>zw ^rcc
set glob="^rcc",last=14,start=13

a        for  {
         set glob=$q(@glob,1,val) quit:glob=""
         set sub=$qs(glob,3)
         if sub=start write glob," >> ",val,!
         else  if sub]start,sub']last write glob," >> ",val,!
         else  write glob,!

^rcc(9372,14,13) >> SUB1=14,SUB2=13
^rcc(9372,14,14) >> SUB1=14,SUB2=14
^rcc(9372,17,13) >> SUB1=17,SUB2=13
^rcc(9372,17,14) >> SUB1=17,SUB2=14