The package is set to run in source generator mode, which means that it won't actually add a dependency.

Not formally no but from what I can tell it just copies the runtime package into the source of the project.
But even if that's fine, the whole point of the package is to provide the APIs that lock provides to <NET 9, but we're not even using those - the entire package can be replaced with some #if NET9_0_OR_GREATERs with no consequence or extra build dependencies. This feels like the package was just added for the sake of adding the package.

Right, but those directives are both an eyesore and limiting in scope. Yes, currently only the lock keyword is used but the polyfill allows for using the whole API.

For starters, using the preprocessor directives won't allow you to lock with a timeout, or you'd have to use preprocessor directives on the timeout lock call too.