Villain NPCs don't fall under the same jurisdiction since they're not normally playable anyway. So the regular rules apply - if the villain is attached to a hero currently being played, reach out to that player for permission. If the hero has no player currently, even if they're an applied NPC, then there's no real need to ask for permission.