These problems aren’t all the same. A frozen package means downstream dependencies may need to make a decision, but they have plenty of options, including vendoring.

There’s lots of source code on the Internet that’s not maintained; it’s just as-is, one-and-done. Nobody is guaranteed updates for free code.