You're not wrong, but also, npm audit is pretty much a joke, and those "high" vulnerabilities aren't as bad as the terminal would want you to think. Should absolutely be fixed, but just relying on npm audit is a bit simplistic.

Your critique about packages for is-object is valid, though.