Well to be fair, in practice in this universe, nobody gives a damn about security. I meant it more in a normative way. Nobody cares much about the security of

Well to be fair, in practice in this universe, nobody gives a damn about security. I meant it more in a normative way. Nobody cares much about the security of their own code, and even less for the security of their dependencies. At least if you link dynamically, you give an opportunity to your distribution to have someone care about it.