Plus, the system admin doesn't just have to wait on the new security-patched library to be ready, they have to wait for everyone who used Go to recompile and distribute their programs.

So you're redeploying one binary instead of another binary. You still need to deploy something.

In fact, what about just switching connections to freshly launched VMs?