What about closed-source binaries where a patched binary can't be obtained from the vendor?

With closed-source binaries the argument for static linking is the strongest, IMHO, or at least shipping all the required shared libraries and LD_LIBRARY_PATH that in. The amount of times I've had to muck about to make a five-year old game work on a current system is somewhat bonkers, and I would never expect someone unfamiliar with shared library details (i.e. a normal non-tech person, or even a tech person not familiar with C/Linux) to figure all of that out.

Closed source programs almost universally bundle all dependencies (except system ones) irrespective of whether they are using static or dynamic linking. They have to to ensure that they actually run reliably.

The same thing I do if the vulnerability is in the binary itself, and not in a library.

Surely, if you care, you have a mitigation plan for this?

You could link locally, or you could opt not to use them. Or you could restrict dynamic linking to these special cases.

Binary patch it.

Or you can link locally.