A recurrent discussion around security.txt is the question "would it actually solve the problem?". In this case, we've been advised the project's maintainer is

A recurrent discussion around security.txt is the question "would it actually solve the problem?". In this case, we've been advised the project's maintainer is MIA. A security.txt file containing a maintainer's email address wouldn't change anything, as WinonaRyder indicates they have already tried to contact them. Given we appear to be talking about a software product, it's also not clear whether security.txt would just contain contact details for a web developer not related to the software itself. There are many projects living on Github that can't use the /.well-known/ URL after even if they wanted to. That's assuming the author opted in to created a security.txt, which they would have to do in just the same way as any other program.