punycode 2.0.0 is actually identical to 1.3.2 except for the ES6 syntax.

I don't think so.
// punycode, 1.3.2

define('punycode', function() {
    return punycode;
});

// punycode, 2.0.0

/** Define the public API */
const punycode = {
	/**
	 * A string representing the current Punycode.js version number.
	 * @memberOf punycode
	 * @type String
	 */
	'version': '2.0.0',
	/**
	 * An object of methods to convert from JavaScript's internal character
	 * representation (UCS-2) to Unicode code points, and back.
	 * @see <https://mathiasbynens.be/notes/javascript-encoding>
	 * @memberOf punycode
	 * @type Object
	 */
	'ucs2': {
		'decode': ucs2decode,
		'encode': ucs2encode
	},
	'decode': decode,
	'encode': encode,
	'toASCII': toASCII,
	'toUnicode': toUnicode
};

module.exports = punycode;

Yes, browserify is mainly target convert ES6 to ES5, if browserify itself contain ES6 code.
Than its verfy difficult run in old browser.

Since you can't change it here. Let me try talk to punycode(1.3.2) to remove the uncomfortable amd id('punycode').

Besides,
The best thing to do here might be to have a new punycode-browserify package that is punycode 2.0.0 compiled to ES5.

Could you help to do it?

Yes I think I worked on one a few months ago. I'll see if I can dig it up on the weekend.

I'm confused what the problem is with the AMD detection; couldn't that be trivially wrapped for CJS?