We're trying to get our test results in Test Explorer rather than through the command line, so in that sense it's required. There seems to be no way to override the react-scripts config in the current TestAdapter code as far as I can tell. I completely understand the security concern though, and I think it can be worked around.

react-app-rewired just loads a 'config-overrides.js' file in the project root (similar to jest.config.js) and uses it to transform the react-scripts output.
Instead of requiring the react-app-rewired package, it should be simple enough to just apply the config-overrides without it.
I think it would still be appropriate to check for react-app-rewired's existence in node_modules in case a user just happens to have an unrelated config-overrides.js in their project root though.

Let me know if this sounds like a better plan and I'll go ahead implement it.