personally I don't think there is that much value in society in endlessly vendoring exactly the same code in various places. This is why we have checksums!
I understand that Google will do this stuff to remove certain stability issues (and I imagine they have their own patches!), but I don't think that this is the fundamental issue relative to practical integration issues that are solvable but tedious.
EDIT:I do think people have reasons for doing vendoring, of course, I don't think that it should be the default behavior unless you have a good reason.
Yes, this is one large difference between development at Google vs most other companies. https://opensource.google/documentation/reference/thirdparty
Personally I think this is what companies should do -- it guarantees hermeticity as you say, guards against NPM repo deletion (left-pad) and supply chain attacks. But for people who are used to just `npm install` there is a lot more overhead.