In practice, there are packages which have moved on to ESM and which no longer maintain their CJS version (at least as actively), making life difficult for maintainers of projects dependent on those CJS packages with published vulnerabilities.

A CJS-targeting build can’t slurp up ESM dependencies. Not without dubious hacks, at least.

See e.g. https://stackoverflow.com/questions/70545129/compile-a-packa...