Good question, Navneet. If there are no policy compliant versions of the package available, then the package goes to quarantine and stays in quarantine until it’s manually released by a waiver.
Waiver documentation is here. Or watch a video here.
As for the life cycle of these packages, that depends on your level of risk tolerance. Our most successful customers have developers send waiver requests to a central location (a Teams channel, an email address) which are then individually evaluated by a team leader or security pro.