[skybrian]

Vendoring is what Linux distributions do. They also provide multi-language automatic builds, security updates and all the other things you mention.

So the problem is not vendoring itself. For a large organization like a Linux distribution, it's a valid technique. However, nobody is maintaining a distribution for the Go ecosystem, or at least not one that's publically available.