They themselves are not, but lets look at another consideration. How will you catch a backdoor added to one of your dependencies? - Scan them and hope someone

They themselves are not, but lets look at another consideration. How will you catch a backdoor added to one of your dependencies? - Scan them and hope someone else noticed and reported before you used it? - Assume your team mates reviewed them when they were updated? - Add SIEM like capabilities and monitor network connections? It should really be all 3. There are counter points of course, but if you vendor them, they'll in a PR and reviewed just the same as the rest of your code. Of course, where do you stop? You trust your distro to do the right thing and you don't review that code, etc. So the more generic question is why do you trust the golang modules you use?