Because many modules don't use ES exports, especially the tiny annoying ones from people like sindresorhus that everything seems to rely on. ES modules are compatible with the browser, CommonJS modules are not.
So I basically don't exclude node_modules, and set up a simple webpack config to suck in my deps and output them as ESM modules to a given static dir of my choice