I completely agree with you, but let's not pretend that Go's dependency manager is free from supply chain attacks vulnerabilities. The whole module mirror shenanigans took a hit on my trust of Go's module management.