[Cthulhu_]

It really depends on how the developers work; if they know the software will have to run for 10+ years, mostly unmaintained / unmonitored, they can opt to vendor all the dependencies so that a future developer can dive into the source of said dependencies.

Also, the Go community tends to frown at adding superfluous dependencies - this is a statement I got while looking for web API frameworks. Said frameworks are often very compact as well, a thin wrapper around Go's own APIs.

I've also worked on a project which had to be future-proofed solidly; all documentation for all dependencies had to be included with the source code.

TL;DR it's down to the developer's approach.