Thank you for your thoughts! I started listening thinking I would agree, but I didn't.

Vulnerabilities do not generally come in through technical details like what style of linking is used. Your attack surface remains the same. Vendoring the code doesn't help either, that's just a distribution and versioning issue.

The only real way to reduce dependencies is to reduce them; Write the code ourselves, or make sure we fully understand our dependencies.

Here's an article that goes further into this: https://medium.com/@kori/systems-easily-understandable-by-one-person-f92e8613e2e