> If the security alert is unfixable (from the project maintainer's perspective, since upstream hasn't released a fix yet), then why are you alerting a maintainer about something unfixable?

Sometimes a vulnerability in a dependency doesn't affect you, because you're not using that feature, in other cases the issue does affect you but it's possible to work around it. For the latter case there isn't necessarily a patch that can be generated automatically.