It doesn't have to be git either - a few version control systems are supported. See https://go.dev/ref/mod#vcs
And it doesn't have to be the direct domain+path of the repository, it can be some URL where you put a metadata file that points to the source repo.
I recall in the Elm community there was a lot of hooplah around the package system aligning too much with a single repo provider (github) so that might be one disincentive there.
How does it prevent squatting in any way?
At least it makes it easy to see the difference between std / official packages (not prefixed) and others.
It doesn't apply to Rust them because std doesn't need to appear in the Cargo.toml file in the first place.