> For a Linux distro, I suspect some people will go crazy if the fix for a security vuln of a small piece of code ends up downloading hundreds of MB [...].

I always wondered about this problem; you could distribute the .o/.a's the same way you currently distribute the .so's, and integrate the linker with the package manager. This theoretically seems to share most of the benefits of both static and dynamic linking: push complexity away from the kernel/dynamic loader, smaller updates = easier patching (compared to fully static binaries), etc. And it works for closed source.

OpenBSD does something similar already for libc and kernel (for boot-time address layout randomisation) and it works great.