Two reasons I can think of: 1) speed to update it in the case of a bug / security issue. 2) backwards compatibility. Getting a new Go release out is likely a

Two reasons I can think of: 1) speed to update it in the case of a bug / security issue. 2) backwards compatibility. Getting a new Go release out is likely a lot more time consuming than bumping up the crypto library outside of there. And those libraries do not require full backwards compatibility compared to the Go standard library. So they can do breaking changes if need back without breaking the Go contract.