That's one of the things I don't like about security scanners, they just check for fetch and friends, and without context, they downgrade your security score.
For example, I have a fully local client-server package that makes no external requests but it gets flagged with "Supply Chain Risk" because it uses `fetch`.