These are several questions cramped into one, so I will try to answer each one individually:
What is prototype pollution and how can it be used by an attacker?
I don't know how much JavaScript knowledge you have, so I will try to remain as generic as possible. JavaScript uses prototypes extensively to implement object inheritance. Basically, whatever you write into the prototype will be in the object instances. The Mozilla documentation will explain this far better than I could.
According to the report on HackerOne, if an attacker is able to insert their own data into lodash, they are able to add their own code to the object. The following PoC demonstrates this:
var _= require('lodash');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
_.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
If you run this code, you can see that a is modified, even if it is never written to directly.
So how does this affect your application? Well, this depends on your code. There is no "catch-all" answer. In some cases it can be a denial of service, in others a remote code execution.
For instance, one could replace the function toString() with a literal string. Attempting to call a string will result in an error, thus leading to a denial of service.
How can a large-scale application deal with a vulnerable package?
Either update your lodash version as soon as possible or apply a manual backport patch yourself. It might not be easy, but it's absolutely necessary.
If your application never processes any user input, then you may delay the update until you can, but it should be pretty high on your priority list.
