> Forking is often impractical in reality as a solo dev or small team rarely has the resources to keep up with security fixes.

Right, then as you've stated your recourse is not to use the library! That's fine and good and means the ecosystem works as intended.