Seems like it’s because they’re using the resolutions feature to override a dependency resolution. The alternative would be forking at least 1 package, all the way down to the dependency, to fix the version.

There’s a reason there’s 3 popular package managers for Node that aren’t NPM. Yes, part of that is the culture/ecosystem, but not entirely.