At the vast majority of companies, if you said to your colleagues “just fork the dependency”, they would look at you like you must be high.
Forking JS packages is easy so I would say those engineers lack passion. Not uncommon unfortunately.
Forking JS packages and maintaining those forks is sometimes technically easy, but it is usually not institutionally easy. Your bosses who actually decide whether you have permission to create and maintain the fork have no regard for your passion when making that decision.
Ignoring security vulnerabilities tends to not work out so well. And sure, you can submit a PR. It might not get merged. Sure, you can just fork it. At that point you might as well use htmx.
I'm certain patching a package is less work than rewriting a project. You should do whatever your heart wants though.