> trusted input (game assets)

Gamedev is its own weird thing, and isn't a model you want to generalize to other industries. It has to optimize for things a lot of software does not, and that skews development.

Vendoring libraries is almost always a terrible idea because it immediately starts to bitrot and become a footgun.

Sometimes it's necessary, but it's not desirable, and you almost always just want to pin your dependencies instead.