IMHO the ideal situation is that both distribution mechanisms are available; single file static binary and also packages for different OS's. Which one you want

IMHO the ideal situation is that both distribution mechanisms are available; single file static binary and also packages for different OS's. Which one you want to use in a given situation is contextual. Murphy's law seems to dictate that the version of the build tool lovingly cared for by the OS's package manager is never the version you actually need. Build tools in particular have a slightly different lifecycle to many things running on a host, which are "owned", cared for and configured by a system administrator. Usually the project you're building "owns" the version of the build tool it needs and there's no guarantee that it will build with a different version. As a consequence, genuine build tool security issues must first be handled by the team making the tool and then by the projects depending on it when they verify compatibility.