AFAIK, Golang's module system (mentioned in the article) protects against this. From [1],
The revision must be an ancestor of one of the module repository’s branches or tags. This prevents attackers from referring to unapproved changes or pull requests.