If the dependency is small, not a binary blob (e.g. pure Python) and the distribution license is compatible, I think directly embedding for one less dependency is wise. Just label it clearly and separate it, e.g. isolated in an “abc-1.2” subdirectory that isn’t mixed with other things.

I’d draw the line at large libraries or binary blobs that are highly likely to not work out of the box for somebody.