Debian discusses vendoring—again

Libraries with hundreds or thousands (yes it happens) of dependencies are dangerous by definition. Alowing multiple versions of those multiplies the problem. Just don't include them and don't use them. Yes, maybe some of them are handy but the risks are just to high.
Those who don't value their privacy and security still have the option of installing that crap without the help of debian. It's even easy.