For me, if a project had a bunch of open PRs for security issues, it would discourage me from using it for new work. It would also help break a tie in my head between keeping an old library and replacing it with something that has legs.

So even if they don't get merged, they still serve a purpose, even if it's just for a few people who behave like I do.