Yeah, but is that because it's unmaintained or because it's finished?

Anything with npm dependencies requires constant updates. The code may be finished but the dependencies publish security updates that need to be pulled in.

It only has devDependencies: https://github.com/olivernn/lunr.js/blob/master/package.json...

Dev dependencies can be a risk factor too. It is code you are running on your own machine after all.