This is basically what Dependabot on GitHub does too. If it finds a vulnerability it creates a PR that you can decide to apply. It's automated to the extent that it's easy but it's not making or forcing changes on you. A human is still in control.
The Snyk tools apply to the patch directly to (e.g.) `node_modules` after the latest code has been downloaded.