> And CMake will take care of transitive dependencies for static libraries for you.

This assumes that everything is correctly expressed as part of the CMake system. If you stick everything in one build system, of course it’s going to be fine.

> Users can replace a .so with a variant that does something you don't expect. For statically linked apps, it is much easier to ensure your code has not been tampered with.

If your users are able to replace libraries, it’s reasonable to assume that they can mess with the code inside your application too. It is generally hard to ensure your code hasn’t been tampered with, unless you’re in control of the hardware.