It could work to just keep using ESLint installed through CRA, but the VSCode ESLint extension doesn't seem to pick it up, of it's not listed among your dependencies. Plus, I don't think it's a good practice to reference a dependency in your code that you don't install manually... But can work for sure.
I agree, there should be some concern over this if a dependency higher up in the tree you don't have control over happens to change than dependent libraries downline could potentially cause issues. This is also the case when using any libraries that depend on Jest as well which also comes prepackaged with CRA. Given that these libraries are the new standard for TS linting with ESLint with full community support my hope is that there will be reasonable support for the latest versions of ESLint. I will mention up above as well this will be solved with CRA 3.0 that will include these libraries OOTB.
We're a place where coders share, stay up-to-date and grow their careers.
We strive for transparency and don't collect excess data.