Earlier quoted context omitted.
In react's case you put your trust in facebook and because of the size most issues get discovered and someone has an article on how to fix before breakfast. When you include left-pad in your own project you should audit it. In the end you are the only line of defense. With react it's larger so you can trust others.
I think that's exactly the problem because of things like this: https://twitter.com/ZacSweers/status/1259176799235387393?s=1... I am the sole maintainer of airbnb/lottie-android despite the fact that I left the company almost 2 years ago and it is used by tens of thousands of companies including Google, Samsung, Microsoft, Uber, Netflix, and countless others.
Doing it yourself I would just freeze versions.
---------
In this case I find it odd for someone to keep maintanier status for a company repo they no longer work for 2 years after leaving.
I would have forked and introduced new changes in my own repo if I cared about the project. Let others follow if they desire new updates or force airbrb to assign someone to update. or better get airbrb to pay you to keep updating.