Well, the trick is to ship your own libpng/libvorbis linked dynamically. So you only update a tiny library than half a gigabyte executable when you need a security fix. You also don't depend on the distro to provide the library.

In fact a lot of indie games that support linux do it this way, setting LD_LIBRARY_PATH with a shell script and it works well.