> Security is one big reason. Avoiding link time or runtime conflicts is another. I mean, most Linux distributions do the same thing - anything that's "vendore

> Security is one big reason. Avoiding link time or runtime conflicts is another. I mean, most Linux distributions do the same thing - anything that's "vendored" as part of some project is supposed to be patched out from the source and pointed to the single system-wide version of that dependency. And Debian is packaging lots of Rust crates and Golang modules as build-time dependencies within their archive.