When you turn off the vulnerability scanning for a package it seems to not work, and we still receive regular email alerts.
Activity