Because your potential dependencies will require 5.x as a peer dependency, so you have to use 5.x. Because your current dependencies will fix bugs or introduce features that you need in versions that upgrade their peer dependency to 5.x, so you have to use 5.x. Because the package itself will fix certain bugs that exist in 3.x but will only fix them in 5.x, so you have to use 5.x.
Forking JS packages and maintaining those forks is sometimes technically easy, but it is usually not institutionally easy. Your bosses who actually decide whether you have permission to create and maintain the fork have no regard for your passion when making that decision.
Ignoring security vulnerabilities tends to not work out so well. And sure, you can submit a PR. It might not get merged. Sure, you can just fork it. At that point you might as well use htmx.
