Looks good to me, great work!

So, I am wondering whether introducing a flag to control it, such as reExportProtoFromExternal

Yes, I agree. This really is an edge case that of course we should somehow be able to handle, but it adds a lot of overhead to 99% of libraries without any benefit.
output. reExportProtoFromExternal sounds like a good name to me, but of course such a feature would need documentation, which would create some overhead. I think it should be enabled by default for maximum compatibility, but the docs should strongly suggest to disable it as you very likely will not need it.
Do you want to have a go within this PR? Otherwise I think we can also release it as it is and tackle this in a separate PR.

Great work!
The only thing left to do is to add the CLI option to the separate list of CLI options:

In cli/help.md:

  --preserveSymlinks          Do not follow symlinks when resolving files
+ --no-reexportProtoFromExternal Ignore `__proto__` in star re-exports
  --no-sanitizeFileName       Do not replace invalid characters in file names

This text is a suggestion. Here, if the default is "true", we would list the negated option but sort it by its non-negated name. Descriptions should fit within 80 characters.

And this list is duplicated (unchanged!) into docs/command-line-interface/index.md.