I have been doing internal repositories and vendoring since 2000, only for personal projects do I do otherwise as they are mostly throw away stuff.

Teaching good security practices and application lifecycle management seems to always be an uphill battle.