I know you can, but do blog-like sites really Island architecture?

IMO most sites like that would be better to pick no-framework, vanilla or jQuery for interactivity.

I can't image average WP users would be happy to move to EmDash, only to have a constant stream of dependabot updates for Astro.

It has 55 direct (non-dev) dependencies https://www.npmjs.com/package/astro?activeTab=dependencies - while ejs has 0 and nunjucks has 3.

I'm weary of updates, maybe it's just me, but I doubt it.

After all these cases like axios it's definitely reasonable. But many people already use Astro. And with static website there are far fewer attack surfaces compared to a full-on PHP running WordPress on a VPS.