Correction: they didn’t ‘realize they needed to make a breaking change’, they got excited by the improvements they could unlock by using the Fetch API and wanted to make a breaking change.
The upgrade is completely voluntary: it won’t even be set as the default version in npm till next year, and there are no known security issues that would force anyone to upgrade. People happy with v2 can just stay on it for the foreseeable future.