I don't think vendored copies are a special case or unrelated. For example, Debian does not allow vendored copies of libs. You have to use the version provided

I don't think vendored copies are a special case or unrelated. For example, Debian does not allow vendored copies of libs. You have to use the version provided by the system, even if it's out of date or not the one you prefer. This explicit disallowing of different code versions also greatly improves security and threat response. This recently (ish) bit hyprland, because they used a pinned version of wlroots, and the version of wlroots on Debian wouldn't work. And they couldn't just dynamically link to this pinned wlroots because that's still not around. If the version of wlroots in Debian, hypothetically, contains a vulnerability, then only one change is needed instead of two. I would argue if you allow static linking you implicitly encourage vendoring. I can't imagine such a distro where static linking is allowed, but there are 0 packages which use different lib commits.