> Author insists this is a problem with all package managers, that it's impossible to write a tool that doesn't behave like this

Is the author wrong? Dependabot functions the exact same way. How would you even go about solving this?