Does the npm registry expose release notes in a standardized way? I've seen release notes in:
While SemVer at least lets me know if there's a breaking change, it would be really nice to review what features or bug fixes a package author may have added.
There is no such standardization as it's completely up to the project developer(s) to define how such information is conveyed. Some might have a NEWS file, others might have a Changelog.md, or yet others may have it in the places that you mentioned. The locations and file formats can vary widely.
It is possible that npm could adopt some optional thing that can automatically display some plaintext file using some kind of fixed naming scheme (and possibly falling back to a git diff if a git repo is defined in package.json), but as of this writing there is no such feature.