NPM: sub-dependency of local dependency has require() in ES module and causes runtime error in production build

Question

I have a Vue3 app under Vite. It's working marvellously in dev, but after adding a dependency, the production build falls over at runtime with require() is not defined. Grubbing down into node_modules, I see my dependency has a sub-dependency that has ES and commonjs variants, and in the .es5.js there's a require() statement. If I replace this with an import directly in the built file, my problem goes away. Have I put my finger on it? It's not my build chain? A require statement has no place in and ES module, am I right? If so, I'm dependent on the package author to fix this?