Not everyone in the Go community uses vendoring or Go modules.
In both LXD and distrobuilder, we don’t use those mechanisms as, so far at least, they cause more problems for us than they’re worth.
The vast majority of Go projects do not issue security advisories when a critical security issue is resolved. As a result, pinning on old versions of those external dependencies means that you may well be vulnerable to critical security issues.
Short of having our external dependencies maintain proper stable branches, stable APIs and issue security notices, the best alternative is to just always build with what’s latest and deal with the occasional breakages (that are very few as we have low tolerance for external dependencies breaking API and will very actively move away from them).
For distributions, our official release tarballs do include a copy of all external dependencies at the time of release so this is what you’d use to be able to rebuild a given release of our projects in a consistent way.