Filtering out a few false positives is easier than auditing every dependency from scratch by yourself, and probably less effort than explaining to your users why your site didn't include a fix for a known vulnerability.

I take your point about "npm audit" being an annoying tool to use, though, and would recommend the package better-npm-audit in its place, which allows developers to ignore specific vulnerabilities by adding entries to a config file that can be committed to the repo.

https://www.npmjs.com/package/better-npm-audit

There's some ongoing work to improve this, by reducing noise & false positives: https://github.com/npm/rfcs/pull/422