The Go tooling won't do that if you configure it properly (e.g. via a 'replace' directive in your go.mod or https://go.dev/ref/mod#goproxy-protocol)

Any tool that automatically assumes that a URL in a Go module import is 'trusted' is just a broken tool.