For Node, the main tradeoff is number and size of files. Usually the distribution of a node module (that which is downloaded into node_modules) contains the source, documentation, distribution, tests, etc. In my current project, it adds up to 500MB already.
They would do well to have an option to optimize dependencies for vendoring.
You're right. We call this "vendoring" your dependencies. And it's a good way to do things.
You can commit your node_modules folder into your repository if you'd like.
That is exactly what NPM does.
I'm a desktop developer so I understand I'm the dinosaur in the room but I've never understood why you would not cache all the component packages next to your own source code.
Since this is straighforward to do I presume there is some tradeoff I've not thought about. Is it security? Do you want to get the latest packages automatically? But isn't that a security risk as well, as not all changes are improvements?