You'd get those benefits from traditional dependencies if you copy them in and never update. Is an AI dependency going to have the equivalent of "upstream fixes"?

Probably? LLMs will train on fixes, then if you run the code through the LLM again to fix it.