I'm torn on how I feel about security being a paid feature in this case. Here the onus is being placed on the user, yet many won't be conscious of the choice they're making.
There's two problems with this that I see. The first is, as you said, that a lot of people won't even realize they need to pay for secure downloads.
I also feel like in the case of something like a package manager, this potentially harms the wider community in ways that charging for features in a specific piece of software doesn't.
Technically paying for an auth token is not sufficient. The token cannot be used directly by Maven or Leiningen, but only by a Nexus proxying repository manager. Not a big deal if you work at a professional Clojure shop, but a huge hassle if you're freelance or just getting started.
The tiff mentioned in the article was interesting to read. > https://twitter.com/mveytsman/status/491298846673473536