I can provide some historical context here; The first version of the deno.land/x registry worked by having a list of repositories that was kept directly in the GitHub repository, anyone could submit a PR to add any other public repository to that list and copied over to deno.land/x. As the site scaled and more and more people wanted to create modules, the model was switched to use GitHub webhooks that have to be set up by the repository owner instead.

lodash and dayjs we submitted in the early days of deno.land/x by community members, so the files of the repo were copied 1:1 over to deno.land/x and that's why you see the package.json file in there -- it's literally the same repository content as lodash.

While the file is available through deno.land/x via the browser or curl, Deno will never actually reach for it; It'll just look at your entrypoint and walk the dependency graph from there, only looking at JS/TS files. In fact I wouldn't be surprised if the versions of lodash and dayjs available on deno.land/x were completely broken in Deno (at least without import maps.)