> this is really about static vs dynamic linkage, regardless of the mechanism you use to effect run or build time binding of dependencies.

No. Distributions have been ensuring security for 20+ years by:

- using dynamic linking

- unbundling/unvendoring dependencies into dedicated packages

- having a security team that updates vulnerable packages in a timely manner

- having tools to update vulnerable packages without having to rebuild/reinstall/reconfigure the world

This is what happens when you don't do that:

https://blog.acolyer.org/2017/04/03/a-study-of-security-vuln...