> and rust developers wouldn't stoop so low as to recognize that e.g. bindgen is a particularly hairy and touchy dependency so they should just vendor the bindings output by bindgen

Why can't Debian do that though?

Moreover vendoring is generally considered a bad practice, more so by Debian, so this just seems a step backwards.