As an aside, it is still possible to vendor dependencies in Golang by using go mod vendor, as described here: https://go.dev/ref/mod#go-mod-vendor
Updating dependencies frequently touched a ton of files.
One approach to being unable to update pinned dependencies was to duplicate code, which created even more of it.
On the plus side, the tooling still seemed to handle the scale. Everything was there for you to look at.
That said, updating dependencies / many code changes because of it isn't necessarily a bad thing. It may need to be restricted to once a month though, unless there's a security incident. But honestly, in Go, dependencies don't change that often so you don't need to update so frequently.