"phpunit/phpunit": "^9.0" requires php>=7.3 so php versions below can not be tested properly. Php versions below are EOL anyway. Sodium is also not available.
But composer still allows this old php versions. Shouldn't they be dropped?

If somebody wants to install the latest release anyway, it can be forced by composer with --ignore-platform-reqs or sticking to an old release.