Re-writing dependency source files with another dependency is a much worse idea than vetting your dependencies before you add them to your project IMHO
If the only other solution is creating your own custom version of a vulnerable dependency, I can see how this could be useful. Not the "best" solution, but certainly practical as far as making code more secure.
Maybe there's a setting to roll back the install if it finds vulnerable dependencies, rather than trying to fix them?