David tells dependency is insecure. Is this a bug, or am I wrong?

I have an issue with one of my repos. The badge shows `insecure` dependencies and this belongs to `jQuery`, as the detail page of `david` told me (and as this is the only dependency too).

https://david-dm.org/eisbehr-/jquery.lazy

The plugin depends on any version greater or equal than `1.7.2`. This is simply to keep the range as wide as possible, even for very old projects, like some IE stuff some companies has still live.

My question is simply, why is my dependency unsecure? On a new install, the most common version `3.2.1` would be picked, what is secure. In my eyes this is a wrong message / badge here. I don't depend on `1.7.2` directly, I depend on everything above too. On a normal install the latest version would be picked.

Can someone tell me the problem?