Might be a hack, but...
If you open devtools before loading dialog for the first time you'll see, that Magnolia makes request to
/magnoliaAuthor/VAADIN/widgetsets/info.magnolia.widgetset.MagnoliaProWidgetSet/ckeditor/ckeditor.js.
Officially there is no proof for that nor this is a preferred solution, but it is possible to generate custom ckeditor bundle with the help of the builder (
https://ckeditor.com/cke4/builder) and place it in:
a) /tomcat/VAADIN/widgetsets/info.magnolia.widgetset.MagnoliaProWidgetSet/ folder (for DX Core)
b) /tomcat/VAADIN/widgetsets/info.magnolia.widgetset.MagnoliaWidgetSet/ folder (for CE)
Keep in mind, that it is outside of webapps folder and might require custom CI/CD configuration
You can replace only minor releases that way, because ckeditor 5 works differently - it relies on es6 modules and it requires refactoring of the server side code of the RichTextField and also newer implementation of the Page link plugin and Asset link plugin