To me that is an argument that doesn't make any sense, at least on Linux. It could make sense if we talk about Windows or macOS, where you typically install sof

To me that is an argument that doesn't make any sense, at least on Linux. It could make sense if we talk about Windows or macOS, where you typically install software by downloading it from a website and you have to update it manually. On Linux it the only thing it should change is that if a vulnerability is discovered let's say in OpenSSL all the software that depends on OpenSSL must be updated, and that could be potentially half the binaries of your system. It's a matter of download size, that in reality doesn't matter that much (and in theory can be optimized with package managers that applies binary patches to packages). It's the maintainers of the distribution that notes the vulnerability in OpenSSL and decides to rebuild all packages that are statically linked to the vulnerable library. But for the final user the only thing he has to do is still an `apt upgrade` or `pacman -Syu` or whatever, and he would still get all the software patched.