GO is a special snowflake case here...
To be fair this has more to do with the fact that Go current toolchain not only encourages, but literally presents as the only option dependency management by pointing them to live repos. That's the only reason why I refuse to invest any time and effort in learning more of it what otherwise looks like a really nifty cross of good and pragmatic ideas and computer science.
Now, the bigger picture can be analysed on and on and on and things like node repos model is braindead too, but at least they pretend. In case of Go it is the official way.
(which might work for google where everything is one big repo and they are so far ahead of everyone else that they rarely need to worry about _external_ dependencies, but is like giving a loaded gauge #4 of buckshot to a depressed teenager and expecting it to end well)